New subject: [Bug 2510305] CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all]

3 Aug 2026

      https://bugzilla.redhat.com/show_bug.cgi?id=2510305
Bug ID: 2510305
           Summary: CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds
                    read via unchecked auth_token_length in protocol v1
                    [fedora-all]
           Product: Fedora
           Version: rawhide
            Status: NEW
        Whiteboard: {"flaws": ["382316db-32a7-40a3-9028-c43356402e23"]}
         Component: sssd
          Keywords: Security, SecurityTracking
          Severity: medium
          Priority: medium
          Assignee: sssd-maintainers@lists.fedoraproject.org
          Reporter: snegrini@redhat.com
        QA Contact: extras-qa@fedoraproject.org
                CC: abokovoy@redhat.com, atikhono@redhat.com,
                    lslebodn@redhat.com, pbrezina@redhat.com,
                    sbose@redhat.com, ssorce@redhat.com,
                    sssd-maintainers@lists.fedoraproject.org
            Blocks: 2509760 (CVE-2026-68743)
  Target Milestone: ---
    Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM
responder (src/responder/pam/pamsrv_cmd.c) reads a 32-bit auth_token_length
from the client request but does not validate it against the remaining buffer
size before passing it to sss_authtok_set_password(). When
sss_authtok_set_string() processes the token, it accesses str[len-1] using the
unvalidated length, resulting in a heap-buffer-overflow read. A local attacker
can trigger this by connecting to the world-writable PAM responder socket
(/var/lib/sss/pipes/pam) and sending a crafted protocol v1 authentication
request with an oversized auth_token_length value. The stock PAM client uses
protocol v3, so this is only reachable via raw socket access. Protocol v2
includes an equivalent bounds check (*c+data_size > blen), which is missing
from v1. Successful exploitation crashes the sssd_pam responder, causing a
denial of service for SSSD-mediated authentication. Reported via
PSIRTSUPT-20553 by BreachX Zero Day Labs.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2509760
[Bug 2509760] CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via
unchecked auth_token_length in protocol v1
-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2510305

Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

[Bug 2510305] New: CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all]