Threats Tagged 'cve-2026-68744'

This update for sssd fixes the following issues: Security issues fixed: - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a process crash when a crafted GETHOSTBYADDR request is sent to the NSS responder socket (bsc#1273922). - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed (bsc#1273925). - CVE-2026-68744: improper memory management in the NSS responder can lead to uninitialized heap memory disclosure from the `sssd_nss` process (bsc#1273924). Other updates and bugfixes: - Add `systemd-tmpfiles` configuration file to populate `/var/lib/sss` with the correct permissions on transactional servers (bsc#1274748).

A vulnerability in SSSD's NSS responder allows a local attacker to cause uninitialized heap bytes to be transmitted to the client, potentially disclosing cached directory data and heap layout information. This occurs because the sss_nss_protocol_fill_initgr() function pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped. The flaw only exposes directory-level data and heap pointers, not credentials or hashes. The vulnerability requires local access to the SSSD NSS responder unix socket. No official fix or mitigation meeting Red Hat's criteria is currently available.

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.