Security readout for executives and security teams
Plain-English summary
This flaw can turn a configured U2F second factor into a password-only login path on affected SELinux policy systems. If SELinux blocks pam-u2f from reading a user's Yubico configuration and nouserok is enabled, the second factor may be skipped.
Executive priority
Treat this as a targeted authentication-control risk, not broad remote compromise. Prioritize systems where U2F protects privileged or externally reachable logins, because password compromise could bypass expected 2FA.
Technical view
CVE-2020-24612 affects selinux-policy, also called Reference Policy, version 3.14 through 2020-08-24. The policy mishandles .config/Yubico access, preventing pam-u2f reads under SELinux enforcing mode. With nouserok, reported as authselect's default configuration, unreadable U2F configuration can disable second-factor enforcement.
Likely exposure
Exposure is most likely on Linux systems using the affected selinux-policy/reference policy with SELinux enforcing, pam-u2f authentication, and nouserok behavior. The source bundle does not identify a complete affected vendor or product matrix.
Exploitation context
The source bundle does not report active exploitation, and CISA KEV is false. A successful attacker would need the user's password and a reachable login path where this policy and pam-u2f configuration cause 2FA to fail open.
Researcher notes
The record describes a policy-level authorization failure rather than a pam-u2f parsing flaw. Evidence is specific about SELinux enforcing mode, .config/Yubico access, and nouserok. Public sources do not establish widespread exploitation or a complete platform inventory.
Mitigation direction
- Apply vendor selinux-policy updates that include the referenced .config/Yubico policy correction.
- Review pam-u2f and authselect settings for nouserok behavior on affected systems.
- Configure authentication to fail closed for missing or unreadable U2F configuration where appropriate.
- Check Red Hat or distribution guidance before making production authentication changes.
Validation and detection
- Inventory systems using SELinux enforcing mode with pam-u2f authentication.
- Identify hosts running selinux-policy/reference policy 3.14 through 2020-08-24.
- Confirm pam-u2f can read each user's .config/Yubico configuration under SELinux enforcing mode.
- Review authentication policy for nouserok behavior that could skip U2F.
- Check SELinux audit events for denied pam-u2f access to Yubico configuration files.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-24612 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:N1.45.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=1860888CVE reference · x_refsource_MISC
- https://github.com/fedora-selinux/selinux-policy/commit/71e1989028802c7875d3436fd3966c587fa383fbCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.