New subject: [Bug 2510309] CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all]

3 Aug 2026

      https://bugzilla.redhat.com/show_bug.cgi?id=2510309
Bug ID: 2510309
           Summary: CVE-2026-68744 sssd: sssd: NSS responder uninitialized
                    heap disclosure in initgroups reply [fedora-all]
           Product: Fedora
           Version: rawhide
            Status: NEW
        Whiteboard: {"flaws": ["8b3d17e9-5164-4ac0-8024-62ad1ee46a96"]}
         Component: sssd
          Keywords: Security, SecurityTracking
          Severity: low
          Priority: low
          Assignee: sssd-maintainers@lists.fedoraproject.org
          Reporter: snegrini@redhat.com
        QA Contact: extras-qa@fedoraproject.org
                CC: abokovoy@redhat.com, atikhono@redhat.com,
                    lslebodn@redhat.com, pbrezina@redhat.com,
                    sbose@redhat.com, ssorce@redhat.com,
                    sssd-maintainers@lists.fedoraproject.org
            Blocks: 2509761 (CVE-2026-68744)
  Target Milestone: ---
    Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the
NSS responder (src/responder/nss/nss_protocol_grent.c) pre-allocates the reply
packet for all group entries using sss_packet_grow() but does not shrink the
packet when groups are skipped (non-POSIX, incomplete, or filtered groups).
sss_packet_grow() uses talloc_realloc_size(), which does not zero-fill newly
allocated memory. The trailing unwritten bytes therefore contain uninitialized
heap data from the sssd_nss process and are transmitted to the client at the
grown packet length. A local attacker can exploit this by sending
SSS_NSS_INITGR (0x0026) requests to the world-writable NSS responder socket
(/var/lib/sss/pipes/nss), receiving uninitialized heap content in the reply
tail. Through heap grooming (for example, a preceding getpwnam query), the leak
can disclose other users' cached directory records and process heap pointers.
The leaked data is limited to the sssd_nss heap (directory-level information);
credentials reside in separate sssd_pam and sssd_be processes. Reported via
PSIRTSUPT-20553 by BreachX Zero Day Labs.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2509761
[Bug 2509761] CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap
disclosure in initgroups reply
-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2510309

Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

[Bug 2510309] New: CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all]