CVE-2021-31924

Publication date 26 May 2021

Last updated 29 August 2025

Ubuntu priority

Cvss 3 Severity Score

Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
pam-u2f	25.04 plucky	Not affected
	24.10 oracular	Ignored end of life, was needs-triage
	24.04 LTS noble	Not affected
	23.10 mantic	Ignored end of life, was needs-triage
	23.04 lunar	Ignored end of life, was needs-triage
	22.10 kinetic	Ignored end of life, was needs-triage
	22.04 LTS jammy	Not affected
	21.10 impish	Ignored end of life
	21.04 hirsute	Ignored end of life
	20.10 groovy	Ignored end of life
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release

Notes

john-breton

Per Debian, PIN verfication was only introduced in 1.1.0. Only versions 1.1.0 to 1.1.1 are vulnerable. Debian also fixed this in 1.1.0-1.1

Severity score breakdown

Parameter	Value
Base score	6.8 · Medium
Attack vector	Physical
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H