CVE-2026-73199: Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

AIONLYREPORT package: ipa-4.13.1-3.el10 ------ Summary: NULL Pointer Dereference in ipa-enrollment Extended Operation (JOINOID) via Missing Request Value: in deployments using the ipa-enrollment SLAPI plugin from ipa-4.13.1-3.el10, a non-anonymous authenticated LDAP client can omit the request value for JOINOID and trigger a NULL pointer dereference in ipajoin(), leading to Directory Server denial of service. Requirements to exploit: Reach a deployment built from ipa-4.13.1-3.el10 where the ipa-enrollment SLAPI plugin is enabled, establish LDAP over a secure channel with SSF greater than 1, authenticate with a non-anonymous account, and send JOINOID without a request value. Component affected: ipa-4.13.1-3.el10: daemons/ipa-slapi-plugins/ipa-enrollment/ipaenrollment.c, ipajoin() via ipaenrollmentextop() handling of JOINOID Version affected: ipa-4.13.1-3.el10 in deployments where the ipa-enrollment SLAPI plugin is built and enabled Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:N - The issue is reachable over the network through LDAP when the vulnerable plugin is exposed. AC:L - The trigger is a simple malformed extended operation with the request value omitted. PR:L - ipajoin() rejects anonymous binds before the dereference, so a non-anonymous authenticated account is required. UI:N - No user interaction is needed once the attacker can send the LDAP request. S:U - The impact is limited to the vulnerable directory service component. C:N - No confidentiality impact is established from the available evidence. I:N - No integrity impact is established from the available evidence. A:H - The NULL dereference can crash the process or otherwise deny Directory Server availability, depending on runtime handling. Impact: Important. This issue lets a remote authenticated client directly compromise service availability with low attack complexity by sending a malformed LDAP extended operation. That aligns with Red Hat's Important rating for flaws that allow remote denial of service, while falling short of Critical because exploitation requires authentication and no confidentiality, integrity, or code-execution impact is established. Embargo: no Reason: The established impact is authenticated denial of service only, with no demonstrated confidentiality or integrity exposure, and the remediation is a straightforward server-side input validation change. Acknowledgement: Aisle Research Vulnerability Details: ipaenrollmentextop() routes JOINOID requests into ipajoin() after OID and secure-connection checks. Inside ipajoin(), the code retrieves SLAPIEXTOPREQVALUE and immediately dereferences extopvalue->bvval without verifying that the request value is present: c / Get the ber value of the extended operation / slapipblockget(pb, SLAPIEXTOPREQVALUE, &extopvalue); / We are passed in the FQDN of the host to enroll. Do an internal search and pull that entry. / filter = slapichsmprintf("(fqdn=%s)", extopvalue->bvval);

A non-anonymous authenticated caller that omits the request value can therefore reach a NULL pointer dereference before the function performs its internal search and before later enrollment ACL checks. Other extended operation handlers in the same source tree explicitly reject NULL or empty request values before use, which supports treating this as a reachable malformed-input case rather than a purely theoretical source defect. Based on the available evidence, the security impact established here is denial of service; the exact failure mode may vary with runtime handling. Steps to reproduce: 1. Use a Directory Server deployment built from ipa-4.13.1-3.el10 where the ipa-enrollment SLAPI plugin is enabled. 2. Connect to LDAP over a secure channel such as StartTLS or LDAPS so that the connection has SSF greater than 1. 3. Bind as a non-anonymous authenticated user, then send LDAP extended operation OID 2.16.840.1.113730.3.8.10.3 (JOINOID) with no request value. 4. Observe a server-side crash or equivalent denial-of-service condition when ipajoin() dereferences extopvalue->bvval. Mitigation: Until a fixed package is available, restrict access to the enrollment extended operation to trusted authenticated clients only. Where host enrollment is not required, disabling the ipa-enrollment SLAPI plugin removes this attack surface. These measures reduce exposure but do not correct the missing NULL check. Proposed Fix: Validate extopvalue immediately after slapipblockget() and reject missing or empty request values before building the internal search filter. diff diff --git a/freeipa-4.13.1/daemons/ipa-slapi-plugins/ipa-enrollment/ipaenrollment.c b/freeipa-4.13.1/daemons/ipa-slapi-plugins/ipa-enrollment/ipaenrollment.c @@ -167,6 +167,14 @@ ipajoin(SlapiPBlock pb) / Get the ber value of the extended operation / slapipblockget(pb, SLAPIEXTOPREQVALUE, &extopvalue); + if (extopvalue == NULL || extopvalue->bvval == NULL || extopvalue->bvlen == 0) { + errMesg = "Missing or empty enrollment request value.\n"; + rc = LDAPPROTOCOLERROR; + goto freeandreturn; + } + / We are passed in the FQDN of the host to enroll. Do an internal search and pull that entry. /

------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat