Executive brief
SSSD (System Security Services Daemon) is a system service that provides user and group database lookups for Linux systems. A flaw in its NSS responder component allows a local attacker to cause the responder process to crash by sending specially crafted requests, resulting in a denial of service that could disrupt authentication and user management on affected systems.
Technical details
This is an input validation vulnerability (CWE-125: out-of-bounds read) in the SSSD NSS responder, specifically in the service lookup request parsers (`sss_nss_protocol_parse_svc_name` and `sss_nss_protocol_parse_svc_port`). The vulnerability allows a local attacker to send specially crafted service lookup requests via the NSS responder's UNIX socket, triggering an out-of-bounds read. The attack vector is local with no privilege or user interaction required. Exploitation can cause a denial of service by crashing the responder process. While unprivileged local clients can reach the socket, there is no evidence of privilege escalation or reliable data disclosure.
Affected products
- Red Hat SSSD
Timeline
- 2026-09-14: disclosed