Comment 0 for bug 2045250

The pam version(s) in Debian (checked buster) and Ubuntu (checked focal to noble) are affected by
https://bugzilla.redhat.com/show_bug.cgi?id=2012871

Customers report a command going through PAM crashing for a given user.
A potential follow on issue can be that no ssh remote connections to an affected server are possible anymore, esp. painful with headless systems (was reported on a different distro).

This is caused by an issue in modules/pam_lastlog/pam_lastlog.c:
with tm = localtime_r(...) that can be NULL and needs to be handled.

There are two such cases in modules/pam_lastlog/pam_lastlog.c (here noble):
314- ll_time = last_login.ll_time;
315: if ((tm = localtime_r (&ll_time, &tm_buf)) != NULL) {
316- strftime (the_time, sizeof (the_time),
317- /* TRANSLATORS: "strftime options for date of last login" */
--
574-
575- lf_time = utuser.ut_tv.tv_sec;
576: tm = localtime_r (&lf_time, &tm_buf);
577- strftime (the_time, sizeof (the_time),
578- /* TRANSLATORS: "strftime options for date of last login" */

Case 1 (line 315) is properly handled, but not case 2 (line 576).

The second case got fixed by:
https://github.com/linux-pam/linux-pam/commit/40c271164dbcebfc5304d0537a42fb42e6b6803c

This fix should be included in Ubuntu (and Debian).