A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

According to the versions of the pam package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.(CVE-2024-10963)

    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.(CVE-2024-10041)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization pam security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1549-1 advisory.

    - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow       file even if it has 000 permissions. This is needed after the CVE-2024-10041       fix in PAM. (bsc#1241678)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0264 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-10041:
    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.

    CVE-2024-10963:
    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-01 (PAM: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PAM. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1505-1 advisory.

    - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow       file even if it has 000 permissions. This is needed after the CVE-2024-10041       fix in PAM.  (bsc#1241678)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1512-1 advisory.

    - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow       file even if it has 000 permissions. This is needed after the CVE-2024-10041       fix in PAM. (bsc#1241678)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1517-1 advisory.

    - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow       file even if it has 000 permissions. This is needed after the CVE-2024-10041       fix in PAM. (bsc#1241678)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1511-1 advisory.

    - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow       file even if it has 000 permissions. This is needed after the CVE-2024-10041       fix in PAM. (bsc#1241678)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1334-1 advisory.

    - CVE-2024-10041: sensitive data exposure while performing authentications. (bsc#1232234)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1158-1 advisory.

    - CVE-2024-10041: sensitive data exposure while performing authentications. (bsc#1232234)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pam installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-10041 advisory.

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pam installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-10041 advisory.

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.5 advisory.

  - virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual     environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as     CVE-2024-9287. (CVE-2024-53899)

  - DHCP can add routes to a client's routing table via the classless static route option (121). VPN-based     security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical     interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic     that was expected to be protected by the VPN. (CVE-2024-3661)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an     attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and     uninitialized memory and leak one byte of uninitialized stack data at a time. (CVE-2024-12085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.7 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.(CVE-2024-10963)

    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.(CVE-2024-10041)

Tenable has extracted the preceding description block directly from the EulerOS pam security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.(CVE-2024-10041)

    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.(CVE-2024-10963)

Tenable has extracted the preceding description block directly from the EulerOS pam security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:11250 advisory.

    * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-11250 advisory.

    - pam_unix: always run the helper to obtain shadow password file entries.
      CVE-2024-10041. Resolves: RHEL-62880
    - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS       situations. CVE-2024-22365. Resolves: RHEL-21244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10379 advisory.

    * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

    * pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11250 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10379 advisory.

    - pam_access: rework resolving of tokens as hostname.
      Resolves: CVE-2024-10963 and RHEL-66242
    - pam_unix: always run the helper to obtain shadow password file entries.
      CVE-2024-10041. Resolves: RHEL-62877

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10379 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

    * pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9941 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236907	EulerOS Virtualization 2.12.0 : pam (EulerOS-SA-2025-1571)	Nessus	Huawei Local Security Checks	high
236900	EulerOS Virtualization 2.12.1 : pam (EulerOS-SA-2025-1555)	Nessus	Huawei Local Security Checks	high
236790	SUSE SLES15 Security Update : apparmor (SUSE-SU-2025:1549-1)	Nessus	SuSE Local Security Checks	medium
235987	Alibaba Cloud Linux 3 : 0264: pam (ALINUX3-SA-2024:0264)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235706	GLSA-202505-01 : PAM: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
235651	SUSE SLES15 Security Update : apparmor (SUSE-SU-2025:1505-1)	Nessus	SuSE Local Security Checks	medium
235637	SUSE SLES15 Security Update : apparmor (SUSE-SU-2025:1512-1)	Nessus	SuSE Local Security Checks	medium
235627	SUSE SLES12 Security Update : apparmor (SUSE-SU-2025:1517-1)	Nessus	SuSE Local Security Checks	medium
235621	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : apparmor (SUSE-SU-2025:1511-1)	Nessus	SuSE Local Security Checks	medium
234605	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pam (SUSE-SU-2025:1334-1)	Nessus	SuSE Local Security Checks	medium
233992	SUSE SLES12 Security Update : pam (SUSE-SU-2025:1158-1)	Nessus	SuSE Local Security Checks	medium
233949	CBL Mariner 2.0 Security Update: pam (CVE-2024-10041)	Nessus	MarinerOS Local Security Checks	medium
233948	Azure Linux 3.0 Security Update: pam (CVE-2024-10041)	Nessus	Azure Linux Local Security Checks	medium
233564	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.5)	Nessus	Misc.	low
233563	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.7)	Nessus	Misc.	critical
228035	Linux Distros Unpatched Vulnerability : CVE-2024-10041	Nessus	Misc.	medium
216017	EulerOS 2.0 SP12 : pam (EulerOS-SA-2025-1194)	Nessus	Huawei Local Security Checks	high
216013	EulerOS 2.0 SP12 : pam (EulerOS-SA-2025-1178)	Nessus	Huawei Local Security Checks	high
215999	EulerOS 2.0 SP11 : pam (EulerOS-SA-2025-1142)	Nessus	Huawei Local Security Checks	high
215998	EulerOS 2.0 SP11 : pam (EulerOS-SA-2025-1161)	Nessus	Huawei Local Security Checks	high
213337	AlmaLinux 9 : pam (ALSA-2024:11250)	Nessus	Alma Linux Local Security Checks	medium
213264	Oracle Linux 9 : pam (ELSA-2024-11250)	Nessus	Oracle Linux Local Security Checks	medium
213213	RockyLinux 8 : pam (RLSA-2024:10379)	Nessus	Rocky Linux Local Security Checks	high
213155	RHEL 9 : pam (RHSA-2024:11250)	Nessus	Red Hat Local Security Checks	medium
212001	Oracle Linux 8 : pam (ELSA-2024-10379)	Nessus	Oracle Linux Local Security Checks	high
211861	RHEL 8 : pam (RHSA-2024:10379)	Nessus	Red Hat Local Security Checks	high
211819	RHEL 9 : pam (RHSA-2024:9941)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2024-10041

medium

Tenable Plugins

high

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

critical

medium

high

high

high

high

medium

medium

high

medium

high

high

medium