SSSD KCM Credential Manager Memory Exhaustion DoS

Executive Summary

This vulnerability is in the System Security Services Daemon (SSSD) and specifically affects the Kerberos Credential Manager (KCM) responder. A local attacker can cause a denial of service by maintaining a persistent connection to the KCM UNIX socket and repeatedly storing and destroying credentials. This leads to unbounded memory growth because the service fails to release cached objects from memory when credentials are removed. The memory is only freed when the connection closes or the responder restarts.

Useful 0 Not Useful 0

Detection Guidance

Monitor memory usage of the sssd-kcm process using tools like top, htop, or ps. Look for persistent growth in memory consumption without corresponding credential operations. Check for unusual activity on the KCM UNIX socket at /var/lib/sss/pipes/sssd_kcm.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited to availability loss for the KCM responder service. An attacker with local access could exhaust system memory, making the KCM responder unresponsive. This does not affect confidentiality or integrity of data but could disrupt services relying on Kerberos authentication managed by SSSD.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts service availability and does not directly affect data confidentiality or integrity. Compliance with standards like GDPR or HIPAA depends on the specific use case, but since no data is exposed or altered, the main concern would be potential service disruption if the KCM responder becomes unresponsive.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the KCM responder if not required by editing /etc/sssd/sssd.conf and setting kcm = false. Restrict access to the KCM socket by modifying filesystem permissions. Restart the sssd service after changes. Monitor memory usage and restart the KCM responder if abnormal growth is detected.

Useful 0 Not Useful 0