Threats Tagged 'cve-2026-68743'

This update for sssd fixes the following issues: Security issues fixed: - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a process crash when a crafted GETHOSTBYADDR request is sent to the NSS responder socket (bsc#1273922). - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed (bsc#1273925). - CVE-2026-68744: improper memory management in the NSS responder can lead to uninitialized heap memory disclosure from the `sssd_nss` process (bsc#1273924). Other updates and bugfixes: - Add `systemd-tmpfiles` configuration file to populate `/var/lib/sss` with the correct permissions on transactional servers (bsc#1274748).

CVE-2026-68743 is a medium severity vulnerability in the SSSD component of Red Hat Enterprise Linux 10. It involves an out-of-bounds read in the extract_authtok_v1() function of the PAM responder due to improper validation of the auth_token_length field. A local attacker with access to the PAM responder socket can send crafted protocol v1 requests to cause a denial of service by crashing the process. The vulnerability affects specific versions of SSSD as listed. No official fix or mitigation meeting Red Hat's criteria is currently available.

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.