CVE-2020-24612

Name	CVE-2020-24612
Description	An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
refpolicy (PTS)	stretch	2:2.20161023.1-9	fixed
	buster	2:2.20190201-2	fixed
	bullseye	2:2.20210203-7	fixed
	bookworm	2:2.20221101-9	fixed
	sid, trixie	2:2.20241211-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
refpolicy	source	(unstable)	(not affected)

Notes

- refpolicy <not-affected> (Debian package doesn't ship pam-u2f config)
https://bugzilla.redhat.com/show_bug.cgi?id=1860888
https://github.com/fedora-selinux/selinux-policy/commit/71e1989028802c7875d3436fd3966c587fa383fb