SSSD PAM Responder NULL Pointer Dereference DoS

Executive Summary

This vulnerability is a NULL pointer dereference flaw in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder crashes due to dereferencing a NULL pointer, disrupting SSSD-backed authentication. Repeated crafted requests can sustain a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor for crashes in the sssd_pam process or failed authentication attempts via SSSD. Check logs for NULL pointer dereference errors in /var/log/sssd/ or journalctl logs for sssd_pam. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a local attacker to crash the SSSD PAM responder, disrupting authentication services that rely on SSSD. This can lead to a denial of service for users attempting to authenticate via SSSD-backed systems. No confidentiality or integrity impact is reported.

Useful 0 Not Useful 0

Mitigation Strategies

Apply patches from Red Hat if available. Restrict local access to the PAM responder socket. Monitor for suspicious activity targeting the sssd_pam process. Mitigation options may be limited as per Red Hat's assessment.

Useful 0 Not Useful 0