Local Privilege Escalation Vulnerability in pam-u2f Package
Summary
CVE-2025-23013: In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. Affects pam-u2f versions < 1.1.0-1.1+deb11u1. Fixed in 1.1.0-1.1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pam-u2f package is a Pluggable Authentication Module (PAM) designed to facilitate secure authentication using YubiKey or other FIDO compliant authenticators on macOS and Linux systems. This package enhances security by enabling two-factor authentication, thereby adding an extra layer of protection against unauthorized access. However, it has been identified to have a vulnerability that can lead to local privilege escalation under certain configurations.
Vulnerability Detail
The vulnerability, identified as CVE-2025-23013, allows for an authentication bypass in specific configurations of the pam-u2f package prior to version 1.3.1. An attacker with unprivileged access to the system may exploit this flaw to escalate their privileges. Depending on the system's configuration, the attacker might also need to know the user's password to successfully exploit the vulnerability. This could lead to unauthorized access to sensitive data or system functionalities, posing a significant security risk.
How To Fix
Minimum fixed version
1.1.0-1.1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pam-u2fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the pam-u2f module in their PAM configuration files until the package is updated. This can be done by commenting out the relevant lines in the /etc/pam.d/common-auth file. For example:
#auth required pam_u2f.so
This will prevent the use of YubiKey for authentication, but it is not a long-term solution.
Conclusion
The pam-u2f package is essential for enhancing authentication security on macOS and Linux systems. However, the identified vulnerability (CVE-2025-23013) poses a significant risk if not addressed. Users are strongly advised to update to the latest version to mitigate potential threats and ensure the integrity of their systems.
See every vulnerability recorded for pam-u2f →
FAQ
CVE-2025-23013 is a vulnerability in the pam-u2f package that allows local privilege escalation under certain configurations.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
If immediate updates are not possible, consider disabling the pam-u2f module in your PAM configuration as a temporary workaround.
Failing to address this vulnerability could allow an attacker to gain unauthorized access to your system, potentially leading to data breaches or system compromise.
More information about the pam-u2f package can be found in its official documentation or on the Debian package repository.
Related vulnerabilities
Recent vulnerabilities recorded for pam-u2f.
