New subject: [Bug 2494777] CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssd_pam' process [fedora-all]

30 Jun 2026

      https://bugzilla.redhat.com/show_bug.cgi?id=2494777
Bug ID: 2494777
           Summary: CVE-2026-12610 sssd: Use-after-free crash in SSSD'
                    'sssd_pam' process [fedora-all]
           Product: Fedora
           Version: rawhide
            Status: NEW
        Whiteboard: {"flaws": ["a698ddf8-512e-456f-90fe-129fe3b4753a"]}
         Component: sssd
          Keywords: Security, SecurityTracking
          Severity: medium
          Priority: medium
          Assignee: sssd-maintainers@lists.fedoraproject.org
          Reporter: sbalasub@redhat.com
        QA Contact: extras-qa@fedoraproject.org
                CC: abokovoy@redhat.com, atikhono@redhat.com,
                    lslebodn@redhat.com, pbrezina@redhat.com,
                    sbose@redhat.com, ssorce@redhat.com,
                    sssd-maintainers@lists.fedoraproject.org
            Blocks: 2490288
  Target Milestone: ---
    Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
When authenticating with a YubiKey, the SSSD PAM responder crashes inside
sss_certmap_match_cert because the sss_certmap_ctx pointer passed to it has
already been freed and reused for string data from the p11_child response.
The pointer value 0x6e65687475412056 decodes to ASCII "V Auth en" which is part
from the certificate label "X.509 Certificate for PIV Authentication" returned
by p11_child. This confirms that the freed sss_certmap_ctx memory was reused
during response parsing.
Root cause:
sss_certmap_ctx is owned by the PAM request state. If the request is cancelled
or completes while the asynchronous p11_child process is still running, the
request state (and the context) is freed. When the child eventually returns and
p11_child_done / parse_p11_child_response run, they call sss_certmap_match_cert
with a dangling pointer. The certificate data (token name, label, or
certificate contents) then occupies the freed memory.
Impact:
Denial of service: The PAM responder crashes, breaking authentication in some
cases.
Potential privilege escalation: Because an attacker controls the
smartcard/YubiKey contents, they can influence the data that replaces the freed
sss_certmap_ctx structure, turning this into a controlled use-after-free in a
privileged, long-running process (although this looks hard to exploit).
-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2494777

Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

[Bug 2494777] New: CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssd_pam' process [fedora-all]