SSD Stack Buffer Overflow in RSA Public Key Conversion

Executive Summary

This vulnerability is a stack buffer overflow in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. The flaw occurs when converting RSA components into fixed-size stack buffers without checking their size. If the RSA components exceed buffer limits, stack memory can be overwritten, causing the SSH responder to crash and potentially corrupting process state.

Useful 0 Not Useful 0

Detection Guidance

Check SSSD logs for crashes or memory corruption errors during SSH key conversion. Monitor for SSH responder crashes when processing certificates. Use tools like 'sssd --genconf' to inspect buffer handling in src/util/cert/libcrypto/cert.c. Verify if ssh_use_certificate_keys=true is enabled in SSSD config.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by providing a specially crafted certificate with oversized RSA components. This could lead to denial of service by crashing the SSH responder and may corrupt memory, though arbitrary code execution has not been demonstrated. Exploitation requires the attacker to influence certificate data and meet configured certificate verification requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Disable ssh_use_certificate_keys=true in SSSD configuration to prevent certificate-based SSH key conversion. Update SSSD to the latest patched version if available. Restrict certificate validation to trusted CAs only. Monitor for unusual SSH responder crashes or memory corruption.

Useful 0 Not Useful 0