Integer Underflow in SSSD NSS Responder Leads to DoS

Executive Summary

This vulnerability is in SSSD, a service managing identity and authentication. A local attacker with access to the NSS responder UNIX socket can send a specially crafted packet with an undersized header. This triggers an integer underflow, causing an out-of-bounds memory read during packet parsing. The result is a crash of the responder process, leading to a Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in the SSSD NSS responder process. Check logs for segmentation faults or unexpected terminations in sssd_nss. Examine network traffic for unusually small packets sent to the NSS responder UNIX socket at /var/lib/sss/pipes/nss. Use tools like strace to trace system calls made by local processes interacting with the socket.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited to local users with socket access. It disrupts identity and group resolution services, causing crashes in the NSS responder. This leads to temporary unavailability of user authentication and lookup functions on the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily affects system availability. It does not lead to data disclosure or privilege escalation, so it likely has minimal direct impact on compliance with GDPR or HIPAA. However, prolonged DoS conditions could disrupt access to critical services, potentially affecting operational compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to the NSS responder UNIX socket at /var/lib/sss/pipes/nss to trusted local users only. Apply socket ACLs or peer-UID restrictions to limit which processes can connect. Monitor for suspicious activity involving the socket. Consider disabling the NSS responder if not required. Apply vendor patches if available.

Useful 0 Not Useful 0