Description

A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-14T16:17:42.367Z",
  "pubdate": "2026-09-14T16:17:42.367Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists within the SSSD (System Security Services Daemon) PAM responder.\nThe flaw occurs when the pam_app_services configuration option is enabled and a specially crafted protocol request omits the service item.\nThe vulnerability allows a local attacker with access to the PAM responder socket to trigger a crash of the service, resulting in a Denial of Service (DoS).\nThis impact disrupts system authentication services, effectively preventing users from logging in or authenticating against identity providers.\nThe vulnerability is restricted to local attackers who possess the privileges required to communicate with the SSSD PAM responder socket.\nSuccessful exploitation requires the specific configuration of pam_app_services, limiting the attack surface to environments where this feature is explicitly enabled.\nThere is no evidence of remote exploitability; the threat model is strictly local, but the impact on system availability is critical for managed authentication environments.",
  "technicalDetails": "The vulnerability is rooted in an improper input validation sequence within the SSSD PAM responder component. When the pam_app_services configuration is active, the responder expects a structured protocol request containing specific service information. The software fails to implement adequate null-pointer checks when parsing incoming requests that intentionally omit the mandatory service item field.\nThe attack flow begins with the local attacker establishing a connection to the SSSD PAM responder socket. Because the PAM responder interface handles communication between PAM modules and the SSSD daemon, it assumes that the protocol requests conform to the defined schema. By crafting a request that is syntactically valid but lacks the expected service attribute, the attacker triggers a logic path where the system attempts to reference an uninitialized or NULL memory address associated with the missing service item.\nDuring execution, the SSSD PAM responder attempts to process the request header. When the internal parsing function reaches the code block responsible for identifying the service, the absence of the field leads to a pointer being assigned a NULL value. Subsequently, the application attempts to perform an operation on this NULL pointer. This invalid memory access triggers a segmentation fault (SIGSEGV), causing the SSSD PAM responder process to terminate unexpectedly.\nThe scope of this vulnerability is limited to the PAM responder process. While SSSD as a whole may consist of multiple processes, the termination of the PAM responder directly impacts the ability of the system to handle PAM requests. Consequently, any authentication flow dependent on SSSD—such as local user logins, SSH access, or enterprise identity management—is blocked until the daemon is manually restarted or recovered by a supervisor process. The vulnerability does not grant the attacker elevated privileges or arbitrary code execution; the impact is strictly confined to service availability and Denial of Service. No network exposure is present, as the attack is mediated exclusively through the local Unix domain socket provided by the SSSD architecture."
}