External risk intelligence

Linux-PAM openSUSE Tumbleweed SSH Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-28321

The vulnerability exists in the Linux-PAM authentication module specifically affecting SSH logins. SSH is a common remote access service that is frequently exposed to the internet for administrative or user access, making the vulnerable authentication pathway likely to be reachable from the internet in many deployments.

Authentication Bypass

Linux Pam

before 1.5.2-6.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects authentication for SSH logins on openSUSE Tumbleweed. It could allow unauthorized access if users attempt to log in from IP addresses that are not resolvable through DNS. While the direct impact is limited to specific openSUSE distributions, the underlying authentication mechanism is critical for secure remote access. The main concern is confirming relevance and exposure within our environment.

Authentication bypass for SSH logins.
Allows unauthorized access from unresolvable IPs.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication for SSH logins if the system uses a specific Linux-PAM module and the user attempts to connect from an IP address that cannot be resolved by DNS. This allows unauthorized access to the system.

Requires unresolvable IP address for connection.
Triggered by attempted SSH login bypass.
Results in unauthorized system access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to systems through SSH logins when a user attempts to connect from an IP address that cannot be resolved by DNS. This bypasses normal access restrictions, potentially exposing the system.

SSH login access to systems.
Bypassed authentication via unresolvable IPs.
Unauthorized system access possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in `pam_access.so` primarily impacts openSUSE Tumbleweed and Factory environments, specifically affecting SSH logins. The first practical step is to identify all systems running the affected Linux-PAM versions, confirm if they are internet-facing or hold critical data, and then determine the accountable owner for remediation. Planning should then proceed based on the identified risk and potential impact.

Owner: Infrastructure or Systems Management teams.
Verify: SSH access and system criticality.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Linux-PAM and how does it relate to openSUSE Tumbleweed?

Linux-PAM (Pluggable Authentication Modules) is a flexible library that manages how users authenticate across Linux systems. It allows administrators to set rules for logins and access control. In openSUSE Tumbleweed, specific versions of this package contain a flaw in the pam_access.so module, which handles restrictions for users trying to log in.

How does CVE-2022-28321 create an authentication bypass?

This vulnerability falls under CWE-287, which refers to Improper Authentication. The issue occurs when the system fails to correctly enforce access rules if it cannot resolve a connecting IP address via DNS. Because the module cannot perform the expected check, it incorrectly grants entry, allowing an unauthorized user to bypass the authentication process for SSH logins.

What conditions must be met for this vulnerability to be triggered?

An attacker must attempt to access the system via SSH from an IP address that does not have a corresponding entry in DNS. If the IP can be resolved, the bypass does not occur. The flaw is specifically tied to the failure to process access restrictions when DNS lookup fails, rather than a general failure of the SSH service itself.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of impact if your system uses the affected Linux-PAM module and provides SSH access. Because SSH is commonly used for remote management and is frequently exposed to the internet, systems that are internet-facing or widely accessible may be reached by an attacker attempting this bypass.

How should I respond if I am running affected openSUSE software?

Your first step is to inventory your environment to find any systems running the vulnerable Linux-PAM versions. Once identified, evaluate whether these machines are internet-facing or handle sensitive data. Coordinate with your infrastructure teams to prioritize these systems for updates, focusing your remediation efforts on those with the highest exposure and criticality.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.