This vulnerability in SSSD's NSS responder arises because the sss_nss_protocol_fill_initgr() function pre-allocates memory for all group entries but fails to shrink the reply packet when some groups are skipped. This results in uninitialized heap memory being transmitted to the client, potentially leaking cached directory data and heap layout information. The issue can only be triggered by a local attacker with access to the SSSD NSS responder unix socket. The disclosed information does not include credentials, hashes, or tickets, which reside in separate processes. The primary security concern is that leaked heap pointers could aid an attacker in bypassing ASLR if combined with another memory corruption vulnerability. Red Hat has not provided a patch or mitigation that meets their criteria for ease of use, applicability, or stability as of the advisory date.

The vulnerability allows a local attacker with low privileges to obtain limited directory-level cached data and heap layout information from the sssd_nss process. This information disclosure does not include sensitive credentials or authentication tokens. The main risk is that leaked heap pointers could facilitate bypassing Address Space Layout Randomization (ASLR) if chained with other vulnerabilities. There is no impact on integrity or availability. The CVSS v3.1 base score is 3.3 (low severity), reflecting local attack vector, low complexity, and limited confidentiality impact.

Red Hat currently does not offer a mitigation or fix that meets their criteria for deployment ease, applicability, or stability. Users should monitor the Red Hat advisory for updates regarding patches or mitigations. Since the issue requires local access to the SSSD NSS responder socket, restricting local access to trusted users can reduce risk. No urgent remediation is available or required at this time.