Vulnerability Description
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux-Pam | Linux-Pam | - |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2024:10379
- https://access.redhat.com/errata/RHSA-2024:11250
- https://access.redhat.com/errata/RHSA-2024:9941
- https://access.redhat.com/security/cve/CVE-2024-10041MitigationThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2319212Issue TrackingThird Party Advisory
FAQ
What is CVE-2024-10041?
CVE-2024-10041 is a vulnerability with a CVSS score of 4.7 (MEDIUM). A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this ...
How severe is CVE-2024-10041?
CVE-2024-10041 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-10041?
Check the references section above for vendor advisories and patch information. Affected products include: Linux-Pam Linux-Pam, Redhat Enterprise Linux.