SSSD Denial of Service via Autofs Responder Flaw

Executive Summary

This vulnerability is in SSSD where an unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This causes global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.

Useful 0 Not Useful 0

Detection Guidance

Check if the autofs responder is enabled and accessible by running: systemctl status sssd-autofs. Look for repeated cache invalidation events in logs using: journalctl -u sssd-autofs | grep -i 'cache invalidation' or 'setautomntent'. Monitor high CPU or network usage during autofs operations with: top -c or sar -u 1 5.

Useful 0 Not Useful 0

Impact Analysis

An authenticated local attacker can degrade automount lookup performance and increase load on backend directory services by triggering frequent cache purges. This can lead to system slowdowns, unresponsive services, and potential service outages if the backend providers are overwhelmed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability, which could lead to service disruptions. While it does not directly affect confidentiality or integrity, prolonged outages may violate availability requirements in GDPR, HIPAA, or other standards that mandate timely access to critical services.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to the autofs responder socket by modifying permissions or disabling it if unused with: chmod 600 /var/lib/sss/pipes/autofs or systemctl stop sssd-autofs. Apply SELinux policies to limit access to the responder. Monitor backend directory services for unusual load spikes. Apply patches or updates from Red Hat once available.

Useful 0 Not Useful 0