Description

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-14T16:17:42.517Z",
  "pubdate": "2026-09-14T16:17:42.517Z",
  "executiveSummary": "A denial-of-service (DoS) vulnerability exists within the System Security Services Daemon (SSSD), specifically affecting the Network Security Services (NSS) responder component.\nThe vulnerability allows an authenticated local unprivileged user to trigger an abnormal termination or instability of the NSS responder process by transmitting a malformed request characterized by a zero-length body.\nSuccessful exploitation directly impacts system availability, as the NSS responder is critical for resolving user and group information via the Name Service Switch (NSS) mechanism.\nThe risk is primarily localized to availability, as service disruption prevents the system from correctly resolving identity information until the responder is restarted.\nThe attack requires local access to the system and the ability to interact with the SSSD IPC interface; no specific network exposure is required for the initial trigger.\nThis flaw underscores the need for robust input validation within inter-process communication interfaces in privileged system services.",
  "technicalDetails": "The vulnerability resides within the SSSD NSS responder component, which acts as a bridge between the system's Name Service Switch (NSS) calls and the SSSD backend. SSSD uses a client-server architecture where communication occurs over Unix domain sockets using a specific IPC protocol.\nThe root cause of the vulnerability is improper handling of requests containing a zero-length body or malformed payload structure. When the NSS responder receives a request, it expects a well-defined structure to parse incoming identity queries. If the input buffer provided to the parser is empty or lacks the mandatory fields, the software fails to handle the unexpected state gracefully.\nThe exploitation process follows a specific attack flow: 1. The attacker establishes a connection to the SSSD NSS responder socket. 2. The attacker crafts a request packet that adheres to the IPC protocol header requirements but omits the mandatory request body (setting the length to zero). 3. Upon receiving this request, the responder’s parsing logic attempts to access memory or invoke operations based on the non-existent body. 4. Due to the lack of sufficient input sanitization or bounds checking in the responder's request handling logic, an unhandled exception or illegal memory access occurs within the process.\nThis triggers a crash or persistent instability in the sssd_nss process. Because this is a core service, its termination results in a denial-of-service for all identity resolution requests on the local host. Any process attempting to authenticate or lookup user/group information via NSS will experience delays or total failure, effectively disabling local system security functions dependent on SSSD.\nThe exploitation requires no special privileges beyond local system access, as the SSSD IPC interface is typically accessible to any local user. No network exposure is necessary, as the attack is performed locally via IPC. The lack of validation on the request length indicates a flaw in the input parsing logic prior to processing the request payload."
}