Memory Exhaustion in SSSD Autofs Responder

Executive Summary

This vulnerability is in the System Security Services Daemon (SSSD) where memory allocated during autofs responder requests is not released until the client connection closes. A local attacker can exploit this by keeping a connection open and sending repeated valid requests, causing memory exhaustion and a Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

Check if the autofs responder is running by running systemctl status sssd-autofs. If enabled, monitor memory usage of the sssd process with commands like ps aux | grep sssd or top. Look for repeated autofs requests in logs using journalctl -u sssd-autofs or tail -f /var/log/sssd/sssd_autofs.log.

Useful 0 Not Useful 0

Impact Analysis

The impact is primarily service disruption due to memory exhaustion in the autofs responder. It requires local access to an active autofs responder socket and repeated valid requests. The vulnerability does not affect system confidentiality or integrity, only availability of the responder service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by exhausting memory in the SSSD autofs responder service. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged service unavailability could disrupt access to critical systems, potentially affecting compliance with availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the autofs responder if not required using systemctl disable --now sssd-autofs. Restrict access to the autofs socket by ensuring only trusted local users can reach it. Monitor for unusual memory usage in sssd processes and apply patches when available from Red Hat.

Useful 0 Not Useful 0