CVE-2026-127101: Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped
A flaw was found in SSSD. In src/responder/pam/pamsrvcmd.c, pamforwarderparsedata() dereferences prctx->cliprotocolversion->version without first checking whether the client negotiated a protocol version with SSSGETVERSION. The pointer is initialized to NULL at connection setup and is only populated during version negotiation. A local user able to connect to the PAM responder socket can send a PAM command before SSSGETVERSION, causing a NULL pointer dereference and terminating sssdpam. Repeated requests can sustain denial of SSSD-backed authentication. The review describes a header-only 16-byte request reaching the vulnerable switch. The maintainer confirmed that recent versions do not initialize a non-NULL default and that rejecting requests when cliprotocolversion is NULL is a valid fix. A possible similar issue in sudosrvcmd() was noted by the maintainer but is not established as part of this flaw. This is distinct from CVE-2026-90995 (missing service item in getdomainrequesttype()) and CVE-2026-104042 (zero-length authentication token out-of-bounds read). Source: PSIRTSUPT-25890, finding H-09; security review dated 2026-10-21 and maintainer assessment.
Other sources
A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the PAM responder, reject authentication/PAM requests when cli_protocol_version is NULL, before dereferencing cli_protocol_version->version; require SSS_GET_VERSION protocol negotiation first.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who can connect to the SSSD PAM responder socket can trigger the flaw. No user interaction is required, but the attacker needs local access and low privileges.
What must an attacker send to trigger the crash?
The attacker must send a PAM command before completing protocol-version negotiation with SSS_GET_VERSION. The review indicates that a header-only 16-byte request can reach the vulnerable code path.
What is the operational impact?
The request causes sssd_pam to terminate through a NULL pointer dereference. Repeating the request can sustain a denial of SSSD-backed authentication.
Is this caused by a particular PAM request type or related SSSD issue?
The vulnerable condition is skipping SSS_GET_VERSION before sending a PAM command; the supplied data does not limit it to a specific PAM command. The noted possible similar condition in sudosrv_cmd() is not established as part of this flaw, and this issue is distinct from CVE-2026-90995 and CVE-2026-104042.