sssd Local DoS via Malformed Passkey Authentication Token

Executive Summary

This vulnerability is in the System Security Services Daemon (SSSD). A local user can cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the memory buffer, causing the process to crash and disrupting authentication services.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for crashes in the SSSD PAM responder process, which may indicate exploitation. Monitor logs for segmentation faults or out-of-bounds read errors in sssd_pam. Check if the vulnerable function sss_auth_unpack_passkey_blob() is present in the sssd-2.12.0-1.el10 package by inspecting the src/util/authtok.c file.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited to local denial of service. It disrupts authentication services, causing crashes in the SSSD PAM responder. Exploitation requires local system access but does not enable privilege escalation or code execution. Availability of the system is affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by crashing authentication services, disrupting system availability. For GDPR, this could impact data processing operations requiring continuous authentication. For HIPAA, it may disrupt access to protected health information systems. The impact is limited to availability and requires local access, but prolonged service disruption could affect compliance with availability requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict local access to the PAM responder interface to trusted users only. This limits the ability of attackers to submit crafted passkey blobs. No official patch is available yet, so this workaround is currently the primary mitigation. Monitor Red Hat's advisories for updates or patches.

Useful 0 Not Useful 0