Description

A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-14T16:17:42.220Z",
  "pubdate": "2026-09-14T16:17:42.220Z",
  "executiveSummary": "A memory safety vulnerability exists within the sssd PAM responder's protocol v1 parser, specifically within the pam_parse_in_data() function. This flaw allows a local, unprivileged attacker to trigger an out-of-bounds (OOB) read by submitting a maliciously crafted, empty, or truncated PAM request body through the PAM responder's UNIX socket.\nThe vulnerability manifests as a denial-of-service (DoS) condition, as the out-of-bounds memory access results in the abnormal termination or forced restart of the sssd PAM responder process. Because the responder is a critical component for authentication services, this crash disrupts system-wide authentication capabilities.\nThe exploitation of this vulnerability is confined to the local environment, as the attacker must possess the ability to communicate directly with the local UNIX domain socket utilized by the PAM responder. No remote exploitation is possible through this vector. The vulnerability highlights a failure in input validation and bounds checking during the parsing of protocol v1 data, posing a significant risk to the availability of authentication services in multi-user environments where local clients may interact with the SSSD daemon.",
  "technicalDetails": "The root cause of the vulnerability resides in the pam_parse_in_data() function within the SSSD codebase, which is responsible for deserializing and validating incoming data packets for the PAM responder when protocol v1 is negotiated. The parser fails to adequately validate the length or structural integrity of the incoming data buffer prior to memory access operations.\nThe attack flow commences when a local client initiates a connection to the SSSD PAM responder's UNIX socket. Upon establishing the connection, the attacker explicitly negotiates protocol v1. Following the negotiation, the attacker sends a specially crafted PAM request packet containing an empty or truncated body. When the pam_parse_in_data() function attempts to process this request, it performs read operations based on expected protocol structure offsets that exceed the actual bounds of the provided data buffer.\nThis out-of-bounds read leads to memory corruption or an illegal memory access fault, effectively triggering a segmentation fault or a critical error within the sssd_pam process. The SSSD architecture typically employs monitoring mechanisms that attempt to restart failed responders; however, the ease with which an attacker can trigger this condition allows for repeated crashes, resulting in a persistent state of denial-of-service for legitimate authentication requests.\nThis vulnerability is particularly impactful because it bypasses standard PAM authentication logic, as the crash occurs during the initial parsing of the request before any authentication credentials would be processed or validated. The lack of strict bounds enforcement ensures that even small, malformed packets are sufficient to destabilize the service. There is no requirement for high-level privileges; any user account capable of interacting with the UNIX socket—which is standard behavior for local system users—can initiate the exploit. While the current impact is primarily identified as a local denial-of-service, out-of-bounds memory issues of this nature often warrant investigation into potential information leakage depending on the surrounding memory layout and the specific offsets accessed by the vulnerable function."
}