A local command injection vulnerability in pam_usb allows a low-privileged user to execute arbitrary system commands with elevated privileges.

This vulnerability involves CWE-78 (OS Command Injection) and CWE-116 (Improper Encoding), where user-controlled inputs are not properly neutralized before being passed to a system command. An attacker with local, low-level access can leverage this to gain higher privileges on the host.

The primary risk is local privilege escalation, which allows an attacker who has already gained low-level access to a system to achieve full administrative control. Given the CVSS score of 8.8, this is a high-severity issue that undermines the local security boundary, potentially facilitating further lateral movement or data exfiltration.

Immediate Action: Update the pam_usb package to version 0.8.7 or later to implement the necessary command sanitization.

Proactive Monitoring: Monitor system logs for unusual command execution patterns or unauthorized attempts to leverage local authentication utilities.

Compensating Controls: Enforce strict access control policies on local systems to minimize the number of users with login access, thereby reducing the pool of potential attackers.

Public Exploit Available: Unknown.

Administrative teams should prioritize updating the pam_usb utility across all Linux environments. Because this vulnerability facilitates local privilege escalation, it is imperative to apply the fix to prevent users from gaining unauthorized root-level access to critical infrastructure.