Buffer Overflow in SSSD autofs Responder

Executive Summary

CVE-2026-104029 is a Denial of Service (DoS) vulnerability in SSSD affecting the autofs responder component. It involves an out-of-bounds memory read due to improper buffer offset calculation during request parsing. A local attacker can exploit this by sending a specially crafted request to the autofs responder UNIX socket, causing the process to crash.

Useful 0 Not Useful 0

Detection Guidance

Check if the autofs responder is running and the UNIX socket is accessible. Use commands like 'systemctl status sssd-autofs' to verify service status. Inspect logs for crashes in the autofs responder process using 'journalctl -u sssd-autofs --no-pager -n 50'.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause the autofs responder process to crash, resulting in a DoS. This disrupts services relying on autofs, such as automounting filesystems. Exploitation requires local access to the autofs UNIX socket and the responder must be enabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service (DoS) by crashing the autofs responder process, which may temporarily disrupt services but does not lead to data disclosure or system compromise. For compliance standards like GDPR or HIPAA, the primary concern would be service availability. A DoS could impact systems handling sensitive data, potentially violating availability requirements. However, since the vulnerability requires local access and does not expose data, the direct compliance impact is likely minimal unless critical services are affected.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the autofs responder if not needed using 'systemctl disable --now sssd-autofs'. Restrict access to the autofs UNIX socket by modifying permissions or firewall rules. Monitor for crashes in the autofs responder process as a potential sign of exploitation.

Useful 0 Not Useful 0