New subject: [Bug 2510306] CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all]

3 Aug 2026

      https://bugzilla.redhat.com/show_bug.cgi?id=2510306
Bug ID: 2510306
           Summary: CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds
                    read via unchecked addrlen in GETHOSTBYADDR
                    [fedora-all]
           Product: Fedora
           Version: rawhide
            Status: NEW
        Whiteboard: {"flaws": ["719402a5-fc23-44d6-8dae-61c246541e04"]}
         Component: sssd
          Keywords: Security, SecurityTracking
          Severity: medium
          Priority: medium
          Assignee: sssd-maintainers@lists.fedoraproject.org
          Reporter: snegrini@redhat.com
        QA Contact: extras-qa@fedoraproject.org
                CC: abokovoy@redhat.com, atikhono@redhat.com,
                    lslebodn@redhat.com, pbrezina@redhat.com,
                    sbose@redhat.com, ssorce@redhat.com,
                    sssd-maintainers@lists.fedoraproject.org
            Blocks: 2509762 (CVE-2026-68742)
  Target Milestone: ---
    Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS
responder (src/responder/nss/nss_protocol.c) extracts a 32-bit addrlen value
from the client request but only validates that the body is at least 8 bytes,
without checking that addrlen fits within the remaining packet body. This
unvalidated length is passed through to talloc_memdup() in
cache_req_data_create(), which copies addrlen bytes from the small request
buffer, causing a heap-buffer-overflow read. A local attacker can trigger this
by connecting to the world-writable NSS responder socket
(/var/lib/sss/pipes/nss) and sending a SSS_NSS_GETHOSTBYADDR (0x0053) request
with a large addrlen value and a valid address family payload so that
inet_ntop() succeeds. Successful exploitation crashes the sssd_nss responder,
causing a denial of service for NSS name resolution. Reported via
PSIRTSUPT-20553 by BreachX Zero Day Labs.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2509762
[Bug 2509762] CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via
unchecked addrlen in GETHOSTBYADDR
-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2510306

Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

[Bug 2510306] New: CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all]