Executive brief
SSSD is a critical authentication daemon that manages user accounts and authentication for Linux systems. A flaw in its PAM (Pluggable Authentication Modules) responder can be exploited by local users to crash the authentication service, temporarily preventing all login attempts and causing a denial of service across the system.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the pam_parse_in_data() function of the PAM responder's protocol v1 parser. A local attacker with access to the PAM responder's UNIX socket can trigger the flaw by negotiating protocol v1 and sending an empty or truncated PAM request body. The out-of-bounds read can cause the PAM responder process to crash or restart, resulting in local denial of service. No user interaction or elevated privileges are required for exploitation. Patches are expected but may not be immediately available for all distributions.
Affected products
- sssd sssd <UNKNOWN>
Timeline
- 2026-09-14: disclosed