CVE-2026-68742: Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr
A flaw was found in SSSD. The sssnssprotocolparseaddr() function in the NSS responder (src/responder/nss/nssprotocol.c) extracts a 32-bit addrlen value from the client request but only validates that the body is at least 8 bytes, without checking that addrlen fits within the remaining packet body. This unvalidated length is passed through to tallocmemdup() in cachereqdatacreate(), which copies addrlen bytes from the small request buffer, causing a heap-buffer-overflow read. A local attacker can trigger this by connecting to the world-writable NSS responder socket (/var/lib/sss/pipes/nss) and sending a SSSNSSGETHOSTBYADDR (0x0053) request with a large addrlen value and a valid address family payload so that inetntop() succeeds. Successful exploitation crashes the sssdnss responder, causing a denial of service for NSS name resolution. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs.
Other sources
A flaw was found in SSSD. The sssnssprotocolparseaddr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68742?
The severity of CVE-2026-68742 is rated as medium with a score of 5.5.
How do I fix CVE-2026-68742?
To fix CVE-2026-68742, update SSSD to the latest version that contains the security patch addressing the out-of-bounds read.
What impact does CVE-2026-68742 have on my system?
CVE-2026-68742 can lead to an out-of-bounds read, which may result in application crashes or unexpected behavior in the NSS responder.
Which software is affected by CVE-2026-68742?
CVE-2026-68742 affects the SSSD, specifically the sssd_nss responder component.
How is the out-of-bounds read in CVE-2026-68742 triggered?
The out-of-bounds read in CVE-2026-68742 is triggered via an unchecked addrlen value extracted from a client request in the sss_nss_protocol_parse_addr() function.