CVE-2024-47191 json
pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running…
published 2024-10-09 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-42307
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink.
Patch / fix
- nongnu oath_toolkit 2.6.12
- oath-toolkit Debian 12 2.6.7-3.1+deb12u1
- oath-toolkit Debian 14, Debian 13 2.6.12-1
debian advisories DEBIAN-CVE-2024-47191
- oath-toolkit Ubuntu 22.04 LTS 2.6.7-3ubuntu0.1
- oath-toolkit Ubuntu 24.04 LTS 2.6.11-2.1ubuntu0.1
ubuntu advisories UBUNTU-CVE-2024-47191
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ceph ceph storage 8.1 2:19.2.1-222.el9cp
- cephadm ceph storage 8.1 2:19.2.1-222.el9cp
- liboath ceph storage 8.1, ceph storage 8.0, ceph storage 7.1 +1 more 2.6.12-1.el9cp
- librbd1 ceph storage 8.1 2:19.2.1-222.el9cp
- librgw2 ceph storage 8.1 2:19.2.1-222.el9cp
- rbd-nbd ceph storage 8.1 2:19.2.1-222.el9cp
- ceph-mib ceph storage 8.1 2:19.2.1-222.el9cp
- ceph-base ceph storage 8.1 2:19.2.1-222.el9cp
red hat advisories RHSA-2025:9775RHSA-2025:4664RHSA-2025:4238RHSA-2025:3635
- oath-toolkit openSUSE Tumbleweed 2.6.11.12-1.1
opensuse advisories openSUSE-SU-2024:14389-1
- oath-toolkit CBL-Mariner 2.0 2.6.7-3
- oath-toolkit Azure Linux 3.0 2.6.9-2
azure linux advisories AZL-50121AZL-50124
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- oath-toolkit Arch Linux 2.6.12-1
arch linux advisories AVG-2857
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-47191 updated cvss 7.1
oath-toolkit: Local root exploit in a PAM module
-
Red Hat Ceph Storage 4 liboathaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Ceph Storage 5 liboath, oath-toolkit Red Hat Openshift Container Storage 4 oath-toolkitaffected: workaround, no fix available
-
Red Hat Ceph Storage 6.1 Tools liboath 2.6.12-1.el8cp, liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el8cp, oath-toolkit 2.6.12-1.el9cpfixed: vendor fix RHSA-2025:4238
-
Red Hat Ceph Storage 7.1 Tools liboath 2.6.12-1.el8cp, liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el8cp, oath-toolkit 2.6.12-1.el9cpfixed: vendor fix RHSA-2025:4664
-
Red Hat Ceph Storage 8.0 Tools ceph 19.2.0-124.el9cp, liboath 2.6.12-1.el9cp, cephadm 19.2.0-124.el9cp, librbd1 19.2.0-124.el9cp, librgw2 19.2.0-124.el9cp, rbd-nbd 19.2.0-124.el9cp, +19 morefixed: vendor fix RHSA-2025:3635
-
Red Hat Ceph Storage 8.1 Tools liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el9cpfixed: vendor fix RHSA-2025:9775
-
Red Hat Ceph Storage 6.1 Tools ceph 17.2.6-277.el8cp, ceph 17.2.6-277.el9cp, cephadm 17.2.6-277.el9cp, librbd1 17.2.6-277.el8cp, librbd1 17.2.6-277.el9cp, librgw2 17.2.6-277.el8cp, +37 more Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-329.el8cp, ceph 18.2.1-329.el9cp, cephadm 18.2.1-329.el9cp, librbd1 18.2.1-329.el8cp, librbd1 18.2.1-329.el9cp, librgw2 18.2.1-329.el8cp, +37 more Red Hat Ceph Storage 8.1 Tools ceph 19.2.1-222.el9cp, cephadm 19.2.1-222.el9cp, librbd1 19.2.1-222.el9cp, librgw2 19.2.1-222.el9cp, rbd-nbd 19.2.1-222.el9cp, ceph-mib 19.2.1-222.el9cp, +18 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
- nongnu oath_toolkit
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- gitlab.com /oath-toolkit/oath-toolkit/-/commit/60d9902b5c20f27e70f8e9c816bfdc0467567e1a
- gitlab.com /oath-toolkit/oath-toolkit/-/commit/3235a52f6b87cd1c5da6508f421ac261f5e33a70
- gitlab.com /oath-toolkit/oath-toolkit/-/commit/3271139989fde35ab0163b558fc29e80c3a280e5
- gitlab.com /oath-toolkit/oath-toolkit/-/commit/95ef255e6a401949ce3f67609bf8aac2029db418
- gitlab.com /oath-toolkit/oath-toolkit/-/issues/43
- openwall.com /lists/oss-security/2024/10/04/2
- security.opensuse.org /2024/10/04/oath-toolkit-vulnerability.html
- nongnu.org /oath-toolkit/security/CVE-2024-47191
- openwall.com /lists/oss-security/2024/10/04/2
- openwall.com /lists/oss-security/2024/10/05/1
- openwall.com /lists/oss-security/2024/10/08/1
- openwall.com /lists/oss-security/2024/10/08/2
- openwall.com /lists/oss-security/2024/10/08/4
- openwall.com /lists/oss-security/2024/10/15/7
- openwall.com /lists/oss-security/2024/10/17/1
- openwall.com /lists/oss-security/2024/10/18/1
- openwall.com /lists/oss-security/2024/10/18/2
Sources
- CVE List CVE-2024-47191
- NVD CVE-2024-47191
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.