Summary

The deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned "no remote clients" and granted access.

Impact

An attacker who authenticates from a host connected to the target via a link-local IPv6 segment (common on directly-connected or LAN-adjacent systems) has their remote session reported by w with a zone-indexed address. The deny_remote check silently passes and authentication succeeds as if the connection were local.

Link-local addresses (fe80::/10) are ubiquitous — they are assigned automatically on every IPv6-capable interface — and SSH over link-local with a zone index is a standard configuration on isolated management networks and embedded/IoT environments.

Affected versions

All versions from 0.8.0 (when tmux remote-client detection was introduced) up to and including the current latest release (0.9.2 as of this writing). No patched release has been tagged yet; the fix is available on the master branch (PR #423).

Root cause

The IPv6 regex template terminated the address group immediately with ([[:space:]]+), leaving no provision for non-whitespace characters between the address and the next field. A zone index (%ifname) is not whitespace and caused the match to fail:

# old pattern (simplified)
fe80::1          <- matched
fe80::1%eth0     <- not matched (% is not whitespace)

Fix

Appended [^[:space:]]* immediately after the IPv6 address group to absorb any zone-index suffix before matching the whitespace field separator. Fixed in PR #423.