Description

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-14T16:17:23.400Z",
  "pubdate": "2026-09-14T16:17:23.400Z",
  "executiveSummary": "A vulnerability has been identified within the sssd NSS responder, classified as an input validation flaw that leads to an out-of-bounds read condition. This issue resides in the processing of service lookup requests received via the NSS responder's UNIX domain socket.\nThe vulnerability allows an unprivileged local attacker to trigger a memory access violation, resulting in the termination of the NSS responder process and a subsequent Denial of Service (DoS) for systems relying on sssd for name service resolution.\nWhile the vulnerability facilitates process instability, there is currently no evidence suggesting that it can be leveraged for privilege escalation or the disclosure of sensitive memory contents. Exploitation is restricted to local authenticated or unprivileged users who possess access to the sssd communication socket. The primary risk is service disruption rather than system compromise.",
  "technicalDetails": "The vulnerability exists within the sssd (System Security Services Daemon) NSS (Name Service Switch) responder component, specifically during the handling of incoming service lookup requests. The root cause is a failure in rigorous input validation when processing data sent to the NSS responder's UNIX socket. When an attacker crafts a malicious request with specific input parameters, the responder fails to properly bound check the input before performing memory access operations.\nDuring the parsing phase of the service lookup request, the NSS responder logic attempts to reference memory based on offsets or lengths derived from the attacker-supplied input. Due to the lack of sufficient validation, these calculations can result in an out-of-bounds (OOB) memory read. An OOB read occurs when the process attempts to access a memory address outside the intended buffer or allocated memory region. If the read operation attempts to access memory pages that are not mapped to the process or are restricted, the operating system kernel sends a SIGSEGV (Segmentation Fault) signal to the sssd process, causing it to crash.\nThe attack flow proceeds as follows: First, the local attacker establishes a connection to the sssd NSS responder via the defined UNIX socket path, which is typically accessible to local users. Second, the attacker transmits a specially crafted service lookup request containing malformed or overflow-inducing parameters. Third, the NSS responder's parsing routines process the payload, failing to enforce boundary constraints on the input data. Finally, the internal pointer arithmetic leads to an OOB read, triggering a memory fault that crashes the NSS responder daemon.\nThis vulnerability is constrained by the local environment. Because the socket is accessible to unprivileged local clients, the barrier to exploitation is low, provided the attacker has local shell access. However, the impact is strictly limited to service availability. Because the crash occurs within the responder process, it does not necessarily compromise the integrity of the underlying system kernel or escalate the attacker's execution context. Post-exploitation analysis indicates that the responder process terminates, disrupting name services until the service is manually or automatically restarted. There is no evidence indicating the exploit can lead to arbitrary code execution or the reliable exfiltration of data from the sssd memory space."
}