Integer Underflow in SSSD Autofs Responder Leads to DoS

Executive Summary

This is a Denial of Service (DoS) vulnerability in SSSD's autofs responder component. A local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, crashing the responder process and disrupting service.

Useful 0 Not Useful 0

Detection Guidance

Check if the autofs responder is enabled in SSSD configuration by inspecting /etc/sssd/sssd.conf for the autofs responder section. Verify if the UNIX socket for autofs responder exists at /var/lib/sss/pipes/nss or similar path. Monitor logs for autofs responder crashes or errors in /var/log/sssd/.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can crash the autofs responder process, leading to a temporary loss of service for automount functionality. It requires local access and a configured autofs responder socket to exploit. No privilege escalation or data loss occurs, but availability is affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service (DoS) by crashing the SSSD autofs responder process through a local attack. It does not lead to data breaches, privilege escalation, or unauthorized access, which are primary concerns for GDPR and HIPAA compliance. The impact is limited to service availability disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the autofs responder in SSSD configuration if not needed by setting autofs_provider to none in /etc/sssd/sssd.conf and restarting SSSD. Restrict access to the autofs responder UNIX socket by adjusting file permissions or using firewall rules. Apply available patches from Red Hat or your distribution vendor as soon as they are released.

Useful 0 Not Useful 0