The vulnerability is a stack buffer overflow in the 389 Directory Server (389-ds-base) component, specifically in the get_ruvelement_from_berval() function within repl5_ruv.c. This function copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking, allowing a remote unauthenticated attacker to crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation with a replica ID field containing more than 16 digit characters. The overflow occurs during payload decoding before any authorization checks, so no credentials are required on default configurations with anonymous access enabled. Stack protectors and ASLR prevent code execution, limiting the impact to denial of service. Mitigations include disabling anonymous access (setting nsslapd-allow-anonymous-access to 'off' or 'rootdse') or restricting network access to trusted replication partners. Red Hat has released a security update (389-ds-base-2.2.4-20.el9_2) for Red Hat Enterprise Linux 9.2 and related products that addresses this vulnerability.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the 389 Directory Server LDAP service. There is no impact on confidentiality or integrity as exploitation is limited to denial of service due to stack protection mechanisms (stack canaries) and ASLR preventing code execution. Systems with default configurations allowing anonymous access to the LDAP service are exposed. Systems that restrict network access to trusted replication partners or disable anonymous access are not exposed to unauthenticated exploitation.

A security update fixing this vulnerability is available from Red Hat and should be applied promptly. Alternatively, administrators can mitigate the risk by disabling anonymous access to the LDAP server by setting nsslapd-allow-anonymous-access to 'off' or 'rootdse' in the server configuration. Another mitigation is to restrict network access to the LDAP port to trusted replication partners only using firewall rules. These mitigations reduce exposure to unauthenticated denial of service attacks without requiring immediate patching.