SSSD vulnerabilities

In SSSD (System Security Services Daemon), a flaw exists where pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption, potentially leading to DoS.

In SSSD, a race condition in the autofs responder between asynchronous enumeration completion and map invalidation can be exploited by a local user to cause memory leaks, leading to excessive memory consumption that can disrupt or crash the autofs service.

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop, leading to high CPU utilization and service stalls.

A flaw was found in SSSD due to a missing state validation check in passkey Kerberos handling. A local attacker can send a specially crafted PAM request when passkey authentication is enabled, causing the PAM responder to dereference an uninitialized pointer and crash.

A flaw was found in SSSD where a local attacker with access to the NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This causes an out-of-bounds memory read during packet parsing, crashing the responder process.

A flaw was found in SSSD due to missing input validation in the PAM responder. A local attacker can send a crafted PAM request containing a zero-length authentication token, causing the service to read beyond buffer boundaries and crash the PAM responder.

A flaw was found in SSSD's NSS responder negative cache. An unprivileged local user can repeatedly request lookups for nonexistent entries, causing the cache to grow without bound because it does not limit the total number of stored entries.

A flaw was found in SSSD when configured with the Entra ID identity provider, where lookup names containing single quotes are not properly escaped before being included in Microsoft Graph OData queries. A low-privileged local user can alter query filters to broaden user or group searches.

A flaw was found in SSSD's GSSAPI authentication handling in the PAM responder, where cached connection state is freed without clearing the reference pointer. A local user can send an additional request over the same connection, causing the service to access invalid memory and terminate unexpectedly.

A flaw was found in SSSD where, in LDAP environments configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method can bypass access control restrictions.

A flaw was found in SSSD where the service fails to verify the presence of the SID extension before processing it in deployments configured with SID-based certificate mapping rules. A remote attacker can submit a certificate lacking the expected SID extension, causing the process to crash during authentication or lookup operations.

A flaw was found in SSSD where a local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process.

The NFS idmap plugin in SSSD fails to abort after detecting that a cached entry exceeds the destination buffer size, leading to an out-of-bounds write. A local attacker can trigger this by requesting identity lookups that resolve to oversized cached entries, causing a crash of the identity mapping service (DoS) and potential corruption of adjacent process memory.

In the Kerberos Credential Manager (KCM) responder in SSSD, the service fails to release cached objects from memory when credentials are removed. A local user can maintain a persistent connection and repeatedly store and destroy credentials, causing continuous memory growth and ultimately exhausting available memory, rendering the service unresponsive (DoS).

A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder in SSSD during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

In SSSD, when configured to enforce account expiration using LDAP shadow attributes, an expiration value of zero is not treated as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system, allowing unauthorized access after the account was intended to be deactivated.

In SSSD, an unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.

In SSSD, when the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.

A flaw was found in SSSD where improper buffer offset calculation during request parsing in the autofs responder UNIX socket leads to an out-of-bounds memory read. A local attacker can send a specially crafted request to trigger this issue. This causes the autofs responder process to crash, resulting in a denial of service (DoS).

In SSSD configured with the LDAP access provider and ldap_access_order including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user.

A flaw was found in sssd where a local unprivileged user can send a specially crafted request with a zero-length body to the NSS responder. This can lead to instability or termination of the NSS responder, causing denial of service.

A flaw was found in SSSD where a local attacker with privileges to connect to the PAM responder socket can send a specially crafted protocol request. If `pam_app_services` is enabled and the service item is omitted, a NULL pointer dereference can occur, crashing the PAM responder and disrupting authentication services.

A flaw was found in sssd in the PAM responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body, triggering an out-of-bounds read that may cause the PAM responder to terminate or restart, leading to a local denial of service.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This may lead to a denial of service by crashing the NSS responder process.

In SSSD's IdP authentication provider, the eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

In SSSD, the sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the packet size. A local attacker can send a crafted GETHOSTBYADDR request, causing an out-of-bounds read and process crash (DoS).

A path traversal vulnerability was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

A use-after-free vulnerability was found in the SSSD (System Security Services Daemon) PAM component responsible for YubiKey authentication. The flaw is caused by improper memory pointer handling, which can lead to a crash. A local attacker could exploit this by manipulating smartcard or YubiKey contents.

A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).