Denial of Service in SSSD via File Descriptor Exhaustion

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in sssd. A local attacker can exhaust the responder service's file descriptors by opening and maintaining many concurrent connections to a responder socket. This triggers an unthrottled retry loop, causing high CPU usage and stalling the service, which prevents legitimate identity and authentication requests from being processed.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves monitoring for excessive file descriptor usage or high CPU utilization by the sssd responder service. Check for processes with unusually high file descriptor counts using commands like 'lsof -p <sssd_pid>' or 'ls /proc/<sssd_pid>/fd | wc -l'. Monitor CPU usage with 'top -p <sssd_pid>' or 'htop'. Look for stalled authentication requests or timeouts in logs like /var/log/sssd/*.log.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can disrupt authentication and identity services on affected systems. Legitimate users may be unable to log in or access resources, leading to service outages or degraded performance. The impact is local, requiring attacker access to the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by exhausting system resources, which could disrupt authentication and identity management services. While it does not directly impact data confidentiality or integrity, prolonged service disruption may lead to unauthorized access attempts or delays in critical operations, potentially affecting compliance with standards requiring timely access controls or audit logging.

Useful 0 Not Useful 0

Mitigation Strategies

Monitor for high CPU usage or stalled responder service processes. Limit concurrent connections to sssd responder sockets and restrict local user access to prevent abuse.

Useful 0 Not Useful 0