Source: sssd Version: 2.13.1-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for sssd. Unfurtunately at time of this writing, only the bugzilla entries from Red Hat are available. It would be great if you can help identify upstream issues, merge request and commits for the individual issues, please? CVE-2026-104029[0]: | A flaw was found in SSSD. A local attacker can exploit this | vulnerability by sending a specially crafted request to the autofs | responder UNIX socket. Due to improper buffer offset calculation | during request parsing, the service performs an out-of-bounds memory | read. This flaw can cause the autofs responder process to crash, | resulting in a denial of service (DoS). CVE-2026-104030[1]: | A flaw was found in sssd. This vulnerability allows a local user to | cause a Denial of Service (DoS) by submitting a specially crafted | passkey authentication token that lacks null terminators. The | authentication service reads past the end of the provided memory | buffer, causing the process to crash and disrupting authentication | services. CVE-2026-104031[2]: | A flaw was found in SSSD. In configurations where the autofs | responder service is enabled, memory allocated during successful | request processing is not released until the client connection | terminates. A local attacker can exploit this vulnerability by | maintaining an open connection and repeatedly submitting valid | requests, leading to memory exhaustion and a Denial of Service | (DoS). CVE-2026-104032[3]: | A flaw was found in SSSD. An unprivileged local user can repeatedly | request master automount map updates through the autofs responder | due to missing authorization checks. This triggers global cache | invalidation and forces repeated lookups to backend directory | providers, leading to a Denial of Service (DoS) from degraded | automount availability and elevated resource consumption. CVE-2026-104033[4]: | A flaw was found in SSSD. When configured to enforce account | expiration using LDAP (Lightweight Directory Access Protocol) shadow | attributes, SSSD fails to treat an expiration value of zero as an | expired account. A user with valid credentials for an expired | account can exploit this flaw to bypass access controls and | authenticate to the system. This allows unauthorized access to | persist after the account was intended to be deactivated. CVE-2026-104034[5]: | A flaw was found in SSSD. A use-after-free vulnerability exists in | the Kerberos Credential Manager (KCM) responder during Kerberos | ticket-granting ticket (TGT) renewal, where a deferred callback | accesses memory that has already been released. An authenticated | local user with a renewable Kerberos ticket can trigger this issue | on systems configured with KCM renewal, causing the KCM responder | service to crash and resulting in a Denial of Service (DoS). CVE-2026-104035[6]: | A flaw was found in SSSD. An issue in the Kerberos Credential | Manager (KCM) responder allows a local user to cause a Denial of | Service (DoS) by maintaining a persistent connection and repeatedly | storing and destroying credentials. Because the service fails to | release cached objects from memory when credentials are removed, | memory consumption grows continuously, ultimately exhausting | available memory and rendering the service unresponsive. CVE-2026-104036[7]: | A flaw was found in SSSD's NFS idmap plugin. When retrieving cached | user or group names, the plugin detects if an entry exceeds the | destination buffer size but fails to abort before copying data. A | local attacker can trigger this vulnerability by requesting identity | lookups that resolve to oversized cached entries, resulting in an | out-of-bounds write. This flaw primarily leads to a Denial of | Service (DoS) by crashing the identity mapping service, and may also | corrupt adjacent process memory. CVE-2026-104037[8]: | A flaw was found in SSSD. A local attacker can exploit this issue by | sending a specially crafted request with an invalid packet length to | the autofs responder UNIX socket. This causes an integer underflow | and an out-of-bounds memory read, which can crash the responder | process and result in a denial of service (DoS). CVE-2026-104038[9]: | A flaw was found in sssd. A remote attacker can cause a denial of | service (DoS) by submitting a certificate that lacks an expected | Security Identifier (SID) extension. In deployments configured with | SID-based certificate mapping rules, the service fails to verify the | presence of the extension before processing it, causing the process | to crash during authentication or lookup operations. CVE-2026-104039[10]: | A flaw was found in SSSD. A local user can cause a denial of service | (DoS) by disrupting system authentication services. When handling | Generic Security Services Application Programming Interface (GSSAPI) | authentication in the Pluggable Authentication Module (PAM) | responder, cached connection state is freed upon completion without | clearing the reference pointer. An attacker can exploit this by | sending an additional request over the same connection, causing the | service to access invalid memory and unexpectedly terminate. CVE-2026-104040[11]: | A flaw was found in SSSD. When configured with the Entra ID identity | provider, input lookup names containing single quotes are not | properly escaped before being included in Microsoft Graph Open Data | Protocol (OData) queries. A low-privileged local user can exploit | this flaw by submitting a crafted search request, altering query | filters to broaden user or group searches. This can lead to | information disclosure by retrieving unintended directory objects, | as well as a Denial of Service (DoS) through excessive processing | and cache population. CVE-2026-104041[12]: | A flaw was found in SSSD. An unprivileged local user can repeatedly | request lookups for nonexistent entries through the Name Service | Switch (NSS) responder. Because the negative cache does not limit | the total number of stored entries and only removes expired records | when an existing key is rechecked, the cache can grow without bound. | This behavior can lead to memory exhaustion, resulting in a Denial | of Service (DoS) as the responder becomes unresponsive or | terminates. CVE-2026-104042[13]: | A flaw was found in sssd. A local attacker can cause a Denial of | Service (DoS) by sending a crafted Pluggable Authentication Module | (PAM) request containing a zero-length authentication token to the | responder socket. Due to missing input validation, the service | attempts to read beyond buffer boundaries when processing the token, | causing the PAM responder to crash. CVE-2026-104043[14]: | A flaw was found in SSSD. A local attacker with access to the Name | Service Switch (NSS) responder UNIX socket can trigger an integer | underflow by sending a specially crafted request with an undersized | packet header. This issue causes an out-of-bounds memory read during | packet parsing, crashing the responder process and resulting in a | Denial of Service (DoS). CVE-2026-104044[15]: | A flaw was found in sssd. A local attacker can trigger a Denial of | Service (DoS) by sending a specially crafted Pluggable | Authentication Module (PAM) request when passkey authentication is | enabled. Due to a missing state validation check in passkey Kerberos | handling, the PAM responder dereferences an uninitialized pointer | and crashes. This failure disrupts authentication services on the | host. CVE-2026-104045[16]: | A flaw was found in SSSD. A local user can trigger a Denial of | Service (DoS) by exploiting a race condition in the autofs responder | between asynchronous enumeration completion and map invalidation. By | repeatedly sending concurrent map enumeration and invalidation | requests, an attacker can cause memory to leak, leading to excessive | memory consumption that can disrupt or crash the autofs service. CVE-2026-104046[17]: | A flaw was found in SSSD (System Security Services Daemon). When | Identity Provider (IdP) authentication is enabled, pre- | authentication requests retain state in memory without being cleared | or timed out. A local attacker can repeatedly initiate | authentication flows without completing them, causing unbounded | memory consumption. This memory exhaustion can lead to a Denial of | Service (DoS) by degrading or terminating SSSD authentication | services. CVE-2026-104047[18]: | A flaw was found in SSSD. When configured to use Microsoft Entra ID, | search inputs are not properly sanitized before being incorporated | into directory query filters. A local user can exploit this | vulnerability by submitting a crafted lookup request, manipulating | the query logic to cause unauthorized information disclosure from | the directory. CVE-2026-104048[19]: | A flaw was found in SSSD. In trust-enabled identity management | environments, SSSD evaluates Host-Based Access Control (HBAC) rules | by stripping domain qualifiers and comparing only short usernames. | An authenticated user in a trusted domain who shares the same | username as an authorized local account can bypass access policies | and gain unauthorized access to protected services or hosts. CVE-2026-80048[20]: | A flaw was found in `sssd-kcm`. A local user or process able to | connect to the `sssd-kcm` UNIX socket can exploit this | vulnerability. By sending a large request length header and then | stalling the connection, an attacker can cause the system to | preallocate significant memory. This leads to memory exhaustion | within the `sssd-kcm` responder, resulting in a Denial of Service | (DoS) for affected deployments. CVE-2026-88252[21]: | A flaw was found in sssd. A local user can cause a Denial of Service | (DoS) by exhausting the responder service's available file | descriptors (system handles used for open connections). By opening | and maintaining many concurrent connections to a responder socket | while continuing to queue new connection attempts, an attacker can | trigger an unthrottled retry loop. This condition leads to high CPU | utilization and stalls the service, preventing legitimate identity | and authentication requests from being processed. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-104029 https://www.cve.org/CVERecord?id=CVE-2026-104029 [1] https://security-tracker.debian.org/tracker/CVE-2026-104030 https://www.cve.org/CVERecord?id=CVE-2026-104030 [2] https://security-tracker.debian.org/tracker/CVE-2026-104031 https://www.cve.org/CVERecord?id=CVE-2026-104031 [3] https://security-tracker.debian.org/tracker/CVE-2026-104032 https://www.cve.org/CVERecord?id=CVE-2026-104032 [4] https://security-tracker.debian.org/tracker/CVE-2026-104033 https://www.cve.org/CVERecord?id=CVE-2026-104033 [5] https://security-tracker.debian.org/tracker/CVE-2026-104034 https://www.cve.org/CVERecord?id=CVE-2026-104034 [6] https://security-tracker.debian.org/tracker/CVE-2026-104035 https://www.cve.org/CVERecord?id=CVE-2026-104035 [7] https://security-tracker.debian.org/tracker/CVE-2026-104036 https://www.cve.org/CVERecord?id=CVE-2026-104036 [8] https://security-tracker.debian.org/tracker/CVE-2026-104037 https://www.cve.org/CVERecord?id=CVE-2026-104037 [9] https://security-tracker.debian.org/tracker/CVE-2026-104038 https://www.cve.org/CVERecord?id=CVE-2026-104038 [10] https://security-tracker.debian.org/tracker/CVE-2026-104039 https://www.cve.org/CVERecord?id=CVE-2026-104039 [11] https://security-tracker.debian.org/tracker/CVE-2026-104040 https://www.cve.org/CVERecord?id=CVE-2026-104040 [12] https://security-tracker.debian.org/tracker/CVE-2026-104041 https://www.cve.org/CVERecord?id=CVE-2026-104041 [13] https://security-tracker.debian.org/tracker/CVE-2026-104042 https://www.cve.org/CVERecord?id=CVE-2026-104042 [14] https://security-tracker.debian.org/tracker/CVE-2026-104043 https://www.cve.org/CVERecord?id=CVE-2026-104043 [15] https://security-tracker.debian.org/tracker/CVE-2026-104044 https://www.cve.org/CVERecord?id=CVE-2026-104044 [16] https://security-tracker.debian.org/tracker/CVE-2026-104045 https://www.cve.org/CVERecord?id=CVE-2026-104045 [17] https://security-tracker.debian.org/tracker/CVE-2026-104046 https://www.cve.org/CVERecord?id=CVE-2026-104046 [18] https://security-tracker.debian.org/tracker/CVE-2026-104047 https://www.cve.org/CVERecord?id=CVE-2026-104047 [19] https://security-tracker.debian.org/tracker/CVE-2026-104048 https://www.cve.org/CVERecord?id=CVE-2026-104048 [20] https://security-tracker.debian.org/tracker/CVE-2026-80048 https://www.cve.org/CVERecord?id=CVE-2026-80048 [21] https://security-tracker.debian.org/tracker/CVE-2026-88252 https://www.cve.org/CVERecord?id=CVE-2026-88252 Regards, Salvatore
