QSN-8688-1: PAM vulnerability
2026-08-27

Summary:
A system hardening measure could be bypassed.

Details:
Juthawong Naisanguansee discovered that PAM incorrectly cleared failed
login attempt records when certain services invoked the account phase
without first performing authentication. An attacker could possibly use
this issue to reset failed login counters, resulting in authentication
lockout restrictions being bypassed.

Affected QuantaStor releases:
  6.9.1.001 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.1.001 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.1.001 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.1.001 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.0.464 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.0.464 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.0.464 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.9.0.464 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.6.015 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.6.015 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.6.015 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.6.015 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.5.018 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.5.018 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.5.018 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.5.018 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.4.038 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.4.038 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.4.038 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.4.038 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.3.018 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.3.018 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.3.018 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.3.018 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.2.002 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.2.002 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.2.002 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.2.002 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.1.007 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.1.007 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.1.007 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.1.007 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.0.205 jammy: libpam-modules 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.0.205 jammy: libpam-modules-bin 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.0.205 jammy: libpam-runtime 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)
  6.8.0.205 jammy: libpam0g 1.4.0-11ubuntu2.4 (fixed in 1.4.0-11ubuntu2.8)

CVEs: 

References:
  https://ubuntu.com/security/notices/USN-8688-1
  https://launchpad.net/bugs/2164901