CVE-2026-127099: Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion
A flaw was found in SSSD. The rsapubkeytossh() function in src/util/cert/libcrypto/cert.c converts the RSA modulus and public exponent from an X.509 certificate into fixed-size stack buffers using BNbn2bin(), without checking BNnumbytes() against the destination sizes. The exponent buffer is 8 bytes and the modulus buffer is 2048 bytes in the reviewed configuration. RSA components exceeding those sizes can overwrite stack memory, causing the SSH responder to crash and potentially corrupting process state. The LDAP userCertificate;binary to SSH authorized-key lookup path requires an attacker-influenced certificate and sshusecertificatekeys=true. Certificate validation must succeed unless verification is explicitly disabled. The maintainer confirmed the 64-bit exponent buffer limit, the absence of prior SSSD key-size validation, and the feasibility of dynamic allocation; they consider this CVE-worthy because appropriately issued valid certificates may reach the conversion. No end-to-end arbitrary-code-execution exploit is established. Source report: PSIRTSUPT-25890, finding H-06.
Other sources
A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected path is the LDAP userCertificate;binary-to-SSH authorized-key lookup path. It requires SSSD to be configured with ssh_use_certificate_keys=true.
What does an attacker need to exploit the flaw?
An attacker needs to influence an X.509 certificate that is processed through the LDAP certificate lookup path and contains RSA components larger than the fixed conversion buffers. Certificate validation must also succeed unless certificate verification has been disabled.
What is the practical impact currently established?
Oversized RSA components can overwrite stack memory, causing the SSSD SSH responder to crash and potentially corrupting its process state. An end-to-end arbitrary-code-execution exploit has not been established.
What can be done if patching is not immediately possible?
Disable certificate-derived SSH authorized-key lookup by setting ssh_use_certificate_keys=false, or ensure untrusted or oversized RSA certificates cannot enter the LDAP userCertificate;binary lookup path. Do not disable certificate verification as a mitigation.