Executive brief
SSSD is a system daemon that handles user authentication and authorization on Linux systems. When a non-default configuration option (pam_app_services) is enabled, a local attacker can crash the authentication service by sending a specially crafted request, causing authentication failures and service disruption until the daemon is restarted.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in SSSD's PAM responder when the pam_app_services configuration is enabled and a service item is omitted from a PAM protocol request. An authenticated local attacker with privileges to connect to the PAM responder socket can trigger this crash by sending a specially crafted request. The vulnerability causes an immediate denial of service by crashing the PAM responder process, disrupting all authentication services until the daemon is manually restarted. The default SSSD configuration is not affected; exploitation requires both local access and a non-default pam_app_services configuration.
Affected products
- Red Hat SSSD <UNKNOWN>
Timeline
- 2026-09-14: disclosed