---
id: CVE-2024-22365
title: >-
  linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of
  service (blocked login process) via mkfifo because the openat call (for
  protect_dir) lacks O_DIRECTORY.
summary: >-
  linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of
  service (blocked login process) via mkfifo because the openat call (for
  protect_dir) lacks O_DIRECTORY.
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-664
vendor: linux-pam
product: linux-pam
affected:
  - linux-pam < 1.6.0
patched:
  - linux-pam 1.6.0
published: '2024-02-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:19.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22365'
references:
  - url: 'http://www.openwall.com/lists/oss-security/2024/01/18/3'
    label: cve@mitre.org
  - url: 'https://github.com/linux-pam/linux-pam'
    label: cve@mitre.org
  - url: >-
      https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb
    label: cve@mitre.org
  - url: 'https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2024/01/18/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/linux-pam/linux-pam'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-577017.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00459
epssPercentile: 0.39589
ingestedAt: '2026-10-15T03:30:12.639Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-02-15T21:07:13.510998Z'
---

## Overview

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

## Affected

- `linux-pam < 1.6.0`

## Remediation

Upgrade past the affected range:

- `linux-pam 1.6.0`