Sssd-maintainers August 2026

sssd-maintainers@lists.fedoraproject.org

1 participants
4 discussions

[Bug 2510309] New: CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all]
by bugzilla＠redhat.com 18 Aug '26

18 Aug '26

https://bugzilla.redhat.com/show_bug.cgi?id=2510309 Bug ID: 2510309 Summary: CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all] Product: Fedora Version: rawhide Status: NEW Whiteboard: {"flaws": ["8b3d17e9-5164-4ac0-8024-62ad1ee46a96"]} Component: sssd Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: snegrini(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Blocks: 2509761 (CVE-2026-68744) Target Milestone: --- Classification: Fedora Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder (src/responder/nss/nss_protocol_grent.c) pre-allocates the reply packet for all group entries using sss_packet_grow() but does not shrink the packet when groups are skipped (non-POSIX, incomplete, or filtered groups). sss_packet_grow() uses talloc_realloc_size(), which does not zero-fill newly allocated memory. The trailing unwritten bytes therefore contain uninitialized heap data from the sssd_nss process and are transmitted to the client at the grown packet length. A local attacker can exploit this by sending SSS_NSS_INITGR (0x0026) requests to the world-writable NSS responder socket (/var/lib/sss/pipes/nss), receiving uninitialized heap content in the reply tail. Through heap grooming (for example, a preceding getpwnam query), the leak can disclose other users' cached directory records and process heap pointers. The leaked data is limited to the sssd_nss heap (directory-level information); credentials reside in separate sssd_pam and sssd_be processes. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2509761 [Bug 2509761] CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2510309 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2510306] New: CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all]
by bugzilla＠redhat.com 18 Aug '26

18 Aug '26

https://bugzilla.redhat.com/show_bug.cgi?id=2510306 Bug ID: 2510306 Summary: CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all] Product: Fedora Version: rawhide Status: NEW Whiteboard: {"flaws": ["719402a5-fc23-44d6-8dae-61c246541e04"]} Component: sssd Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: snegrini(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Blocks: 2509762 (CVE-2026-68742) Target Milestone: --- Classification: Fedora Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder (src/responder/nss/nss_protocol.c) extracts a 32-bit addrlen value from the client request but only validates that the body is at least 8 bytes, without checking that addrlen fits within the remaining packet body. This unvalidated length is passed through to talloc_memdup() in cache_req_data_create(), which copies addrlen bytes from the small request buffer, causing a heap-buffer-overflow read. A local attacker can trigger this by connecting to the world-writable NSS responder socket (/var/lib/sss/pipes/nss) and sending a SSS_NSS_GETHOSTBYADDR (0x0053) request with a large addrlen value and a valid address family payload so that inet_ntop() succeeds. Successful exploitation crashes the sssd_nss responder, causing a denial of service for NSS name resolution. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2509762 [Bug 2509762] CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2510306 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2510305] New: CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all]
by bugzilla＠redhat.com 18 Aug '26

18 Aug '26

https://bugzilla.redhat.com/show_bug.cgi?id=2510305 Bug ID: 2510305 Summary: CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all] Product: Fedora Version: rawhide Status: NEW Whiteboard: {"flaws": ["382316db-32a7-40a3-9028-c43356402e23"]} Component: sssd Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: snegrini(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Blocks: 2509760 (CVE-2026-68743) Target Milestone: --- Classification: Fedora Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder (src/responder/pam/pamsrv_cmd.c) reads a 32-bit auth_token_length from the client request but does not validate it against the remaining buffer size before passing it to sss_authtok_set_password(). When sss_authtok_set_string() processes the token, it accesses str[len-1] using the unvalidated length, resulting in a heap-buffer-overflow read. A local attacker can trigger this by connecting to the world-writable PAM responder socket (/var/lib/sss/pipes/pam) and sending a crafted protocol v1 authentication request with an oversized auth_token_length value. The stock PAM client uses protocol v3, so this is only reachable via raw socket access. Protocol v2 includes an equivalent bounds check (*c+data_size > blen), which is missing from v1. Successful exploitation crashes the sssd_pam responder, causing a denial of service for SSSD-mediated authentication. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2509760 [Bug 2509760] CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2510305 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2510047] New: can't modify file attributes in /etc at startup, with readonly-root
by bugzilla＠redhat.com 03 Aug '26

03 Aug '26

https://bugzilla.redhat.com/show_bug.cgi?id=2510047 Bug ID: 2510047 Summary: can't modify file attributes in /etc at startup, with readonly-root Product: Fedora Version: 44 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Keywords: Regression Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: jacquelin.charbonnel(a)powermail.fr QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora In /usr/lib/systemd/system/sssd.service, we find : ExecStartPre=+-/bin/chown -f -R -H root:sssd /etc/sssd ExecStartPre=+-/bin/chmod -f -R g+r /etc/sssd ExecStartPre=+-/bin/chmod -f g+x /etc/sssd ExecStartPre=+-/bin/chmod -f g+x /etc/sssd/conf.d ExecStartPre=+-/bin/chmod -f g+x /etc/sssd/pki It doesn't work if /etc is read only (with readonly-root for example). Suggestion : add this line files /etc/sssd in /etc/rwtab Reproducible: Always -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2510047 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

2026

2025

2024

2023

2022

2021

2020

Sssd-maintainers August 2026