products / linux_pam

Linux-PAM

Linux-PAM is the pluggable authentication layer used by login, sudo, SSH, and most PAM-aware daemons on Linux distributions. Modules under /etc/pam.d decide account, auth, password, and session policy for local and networked logins. NVD tracks it as linux-pam:linux-pam. The modern CRITICAL advisory set is small. Most recent issues are local denial of service or information leaks rather than remote root bypasses.

api usage

Querying Linux-PAM

product sluglinux_pam

version format1.5.2, 1.7.0, 1.5.1

bash

curl "https://api.attestd.io/v1/check?product=linux_pam&version=1.5.2" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Linux-PAM 1.5.2 returns risk_state: "high" with CVE-2024-22365 and CVE-2024-10041 listed. The response marks the attack surface as local (remote_exploitable: false).

json

{
  "product": "linux_pam",
  "version": "1.5.2",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2024-22365",
    "CVE-2025-6020",
    "CVE-2026-54411"
  ],
  "cves": null,
  "max_epss": 0.00459,
  "last_updated": "2026-08-10T13:33:11.309780Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Linux-PAM 1.7.0 is a current release past the 1.5.3 / 1.6.0 fix lines referenced for the local DoS class of issues in the example response.

bash

curl "https://api.attestd.io/v1/check?product=linux_pam&version=1.7.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Linux-PAM advisories are sparse at CRITICAL severity. CVE-2020-27780 is the standout modern critical case (empty-password root auth under a narrow precondition). Later entries such as CVE-2024-22365 are local availability issues. Older pam_unix helper flaws mainly enable username enumeration or local DoS when the password database is unreachable.

CVE	Description	Affects	CVSS
`CVE-2020-27780`	Empty-password handling for non-existent users authenticates as root when root has an empty password.	≥1.5.0 <1.5.1	9.8
`CVE-2024-22365`	Missing O_DIRECTORY on protect_dir open lets attackers deny login via mkfifo.	< 1.6.0	5.5
`CVE-2015-3238`	pam_unix helper path allows local username enumeration or denial of service when the password database is inaccessible.	≤1.1.8	6.5

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Linux-PAM CPE namespace

NVD records Linux-PAM under the linux-pam project CPE:

cpe:2.3:a:linux-pam:linux-pamPAM library and module CVEs

Attestd maps linux_pam to this CPE. Distribution package versions usually track the upstream Linux-PAM release string used in NVD ranges.

All products OpenSSH OpenLDAP Quickstart