CVE-2026-104044: Sssd: sssd: denial of service via crafted passkey kerberos authentication request

AIONLYREPORT package: sssd-2.12.0-1.el10 ------ Summary: Reachable NULL Pointer Dereference in passkeykerberos (SSSAUTHTOKTYPEPASSKEYKRB) causing Local DoS: crafted local PAM authentication requests can reach passkeykerberos() before passkey pre-auth state is initialized and crash sssdpam. Requirements to exploit: Local access to the PAM responder socket and the ability to send a crafted SSSPAMAUTHENTICATE request with authtok type SSSAUTHTOKTYPEPASSKEYKRB, a non-NULL passkey prompt and key, and no prior successful SSSPAMPREAUTH that would initialize pktabledata. The affected path is present only when the package is built with BUILDPASSKEY and pampasskeyauth is enabled; deployments that restrict PAM responder access to trusted users reduce reachability. Component affected: sssd-2.12.0-1.el10, PAM responder passkey handling in src/responder/pam/pamsrvpasskey.c (passkeykerberos()), with reachability from src/responder/pam/pamsrvcmd.c and state initialization in savepasskeydata(). Version affected: sssd-2.12.0-1.el10, when built with passkey support (BUILDPASSKEY) and with pampasskeyauth = true Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.2 (MEDIUM) AV:L - exploitation requires local access to the PAM responder socket. AC:L - the attacker only needs to send a crafted request that selects SSSAUTHTOKTYPEPASSKEYKRB without first establishing passkey pre-auth state. PR:N - under the default PAM responder posture in this tree, the crafted request path does not require elevated privileges or prior authorization to the vulnerable code path; restricting responder access to trusted users reduces reachability. UI:N - no user interaction is required once the crafted request is sent. S:U - the crash occurs within the PAM responder's own security scope. C:N - no confidentiality impact was established. I:N - no integrity impact was established. A:H - successful exploitation can crash sssdpam and disrupt authentication handling on the host. Impact: Moderate. Under Red Hat severity guidance, this is best classified as Moderate because it can disrupt availability of an authentication responder, but the available evidence supports only a local denial of service, not remote reachability, privilege escalation, or confidentiality/integrity compromise. The issue is also conditional on passkey support being built and enabled. Embargo: no Reason: This is a local denial-of-service issue with straightforward mitigations, no demonstrated confidentiality or integrity impact, and no evidence of remote exploitation. Public disclosure without embargo is appropriate. Acknowledgement: Aisle Research Vulnerability Details: passkeykerberos() validates that the attacker-controlled passkey blob contains non-NULL prompt and key fields, but it does not verify that pctx->pktabledata exists before dereferencing pctx->pktabledata->table: c if (prompt == NULL || key == NULL) { DEBUG(SSSDBGOPFAILURE, "Passkey prompt and key are missing or invalid.\n"); return EIO; } data = sssptrhashlookup(pctx->pktabledata->table, key, struct pkchilduserdata); if (data == NULL) { DEBUG(SSSDBGOPFAILURE, "Failed to lookup passkey authtok\n"); return EIO; } That state is allocated in savepasskeydata(), which is reached from passkey pre-auth response handling: c pctx->pktabledata = talloczero(tmpctx, struct pampasskeytabledata); if (pctx->pktabledata == NULL) { return ENOMEM; } if (pctx->pktabledata->table == NULL) { pctx->pktabledata->table = sssptrhashcreate(pctx->pktabledata, NULL, NULL); if (pctx->pktabledata->table == NULL) { ret = ENOMEM; goto done; } } The authenticate path can still dispatch to passkeykerberos() based on token type alone: c #ifdef BUILDPASSKEY if ((pd->cmd == SSSPAMAUTHENTICATE)) { if (maydopasskeyauth(pctx, pd)) { if (sssauthtokgettype(pd->authtok) == SSSAUTHTOKTYPEPASSKEYKRB) { ret = passkeykerberos(pctx, preq->pd, preq); goto done; } else if ((sssauthtokgettype(pd->authtok) == SSSAUTHTOKTYPEPASSKEY) || (sssauthtokgettype(pd->authtok) == SSSAUTHTOKTYPEEMPTY)) { ret = passkeylocal(cctx, cctx->ev, pctx, preq, pd); The request parser also accepts SSSAUTHTOKTYPEPASSKEYKRB directly from client input: c case SSSAUTHTOKTYPEPASSKEY: case SSSAUTHTOKTYPEPASSKEYKRB: case SSSAUTHTOKTYPEPASSKEYREPLY: case SSSAUTHTOKTYPEPAMSTACKED: ret = sssauthtokset(tok, authtokentype, authtokendata, authtokenlength); break; As a result, a crafted local SSSPAMAUTHENTICATE request can select the passkey-Kerberos path without first populating pktabledata. When that happens, the dereference of pctx->pktabledata->table triggers a NULL pointer dereference and crashes sssdpam. The available evidence supports availability impact only. Steps to reproduce: 1. Use a build with passkey support enabled (BUILDPASSKEY) and with pampasskeyauth = true. 2. Connect to the PAM responder UNIX socket (.../pipes/pam). 3. Send a protocol v3 SSSPAMAUTHENTICATE request with authtok type SSSAUTHTOKTYPEPASSKEYKRB, a passkey blob containing non-NULL prompt and key fields, and no prior successful SSSPAMPREAUTH that would populate pktabledata. 4. Observe sssdpam crash from the NULL dereference at pctx->pktabledata->table in passkeykerberos(). Mitigation: If passkey authentication is not required, disable pampasskeyauth to remove the vulnerable path. Where operationally feasible, restrict PAM responder access to explicitly trusted users instead of relying on the default trusted-user posture. These measures reduce or remove reachability but do not replace a code fix. Proposed Fix: Add a guard before dereferencing pctx->pktabledata->table and return an error when passkey Kerberos state has not been initialized. diff diff --git a/src/responder/pam/pamsrvpasskey.c b/src/responder/pam/pamsrvpasskey.c — a/src/responder/pam/pamsrvpasskey.c +++ b/src/responder/pam/pamsrvpasskey.c @@ -144,6 +144,13 @@ errnot passkeykerberos(struct pamctx pctx, return EIO; } + if (pctx->pktabledata == NULL || pctx->pktabledata->table == NULL) { + DEBUG(SSSDBGOPFAILURE, + "Passkey KRB state table missing (pre-auth state not initialized).\n"); + return EIO; + } + data = sssptrhashlookup(pctx->pktabledata->table, key, struct pkchilduserdata); if (data == NULL) { ------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat