CVE-2026-90995: Sssd: sssd: local denial of service due to null pointer dereference in pam responder

AIONLYREPORT package: sssd-2.12.0-1.el10 ------ Summary: Local DoS in PAM responder: NULL dereference in getdomainrequesttype() when SSSPAMITEMSERVICE is omitted: a crafted local PAM protocol v2/v3 request that omits the service item can leave pd->service as NULL and trigger a NULL dereference in the PAM responder when [pam] pamappservices is configured, causing denial of service. Requirements to exploit: Local access sufficient to connect to the PAM responder socket and send a crafted PAM protocol v2/v3 request that omits SSSPAMITEMSERVICE; the target must use a non-empty [pam] pamappservices configuration. Component affected: sssd-2.12.0-1.el10, PAM responder code in src/responder/pam/pamsrvcmd.c, specifically pamparseindatav2(), pamparseindatav3(), pamforwarder(), and getdomainrequesttype(). Version affected: sssd-2.12.0-1.el10; reachability depends on a non-empty [pam] pamappservices configuration. Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 5.5 (MEDIUM) AV:L - The issue is reachable only from the local system through the PAM responder's UNIX socket. AC:L - A valid request can be crafted without unusual conditions once the protocol framing and required fields are understood. PR:L - The attacker needs local access equivalent to an unprivileged user that can submit requests to the PAM responder interface. UI:N - No user interaction is required. S:U - The crash affects the same security scope as the vulnerable responder. C:N - No confidentiality impact was established. I:N - No integrity impact was established. A:H - A successful trigger can terminate the PAM responder and block authentication requests handled through it until the service recovers. Impact: Moderate. This is an availability-only issue in a security-relevant local service, but exploitation is local and depends on a non-default yet supported pamappservices deployment. That places it below Important under Red Hat guidance, while remaining above Low because the NULL dereference condition is concrete and can be triggered with a crafted request rather than being purely theoretical. Embargo: no Reason: Current evidence supports a local, configuration-dependent denial of service with straightforward mitigation and no demonstrated confidentiality, integrity, or privilege-escalation impact. Acknowledgement: Aisle Research Vulnerability Details: In PAM protocol v2/v3 request parsing, SSSPAMITEMSERVICE is optional, so the service pointer may remain unset: c case SSSPAMITEMSERVICE: ret = extractstring(&pd->service, size, body, blen, &c); if (ret != EOK) return ret; break; The parsed request is then forwarded unconditionally into domain selection: c preq->reqdomtype = getdomainrequesttype(preq, pctx); getdomainrequesttype() compares configured application services against preq->pd->service without checking for NULL: c for (int i = 0; pctx->appservices[i]; i++) { if (strcmp(pctx->appservices[i], preq->pd->service) == 0) { reqdomtype = CACHEREQAPPLICATIONDOM; break; } } When [pam] pamappservices is non-empty and the request omits SSSPAMITEMSERVICE, the responder can reach strcmp(nonnull, NULL) and terminate with a NULL pointer dereference. The established impact from the available evidence is denial of service in the PAM responder. Relevant CWE: CWE-476 (NULL Pointer Dereference). Steps to reproduce: 1. Configure SSSD with a non-empty [pam] pamappservices value, for example pamappservices = appsvc, and restart the service. 2. Connect locally to the PAM responder socket. In standard builds this is the SSSPAMSOCKETNAME path, commonly /var/lib/sss/pipes/pam. 3. Send a valid PAM protocol v3 request with correct SSSSTARTOFPAMREQUEST / SSSENDOFPAMREQUEST framing, a supported command such as SSSPAMAUTHENTICATE, and the fields needed for parser success, including SSSPAMITEMCLIPID and a user or logon value. 4. Omit SSSPAMITEMSERVICE from the request. 5. Observe the request reach getdomainrequesttype() and dereference preq->pd->service == NULL via strcmp(), causing the PAM responder process to crash. Mitigation: Until a fix is applied, avoid configuring pamappservices where it is not operationally required. If that setting must remain enabled, limit local ability to submit raw PAM responder requests as far as deployment policy allows and monitor for PAM responder crashes. Proposed Fix: Add a NULL check before comparing preq->pd->service against entries in pctx->appservices[]. This preserves the existing application-domain selection behavior for valid service names while avoiding the NULL dereference on requests that omit SSSPAMITEMSERVICE. diff diff --git a/src/responder/pam/pamsrvcmd.c b/src/responder/pam/pamsrvcmd.c index <old>..<new> 100644 — a/src/responder/pam/pamsrvcmd.c +++ b/src/responder/pam/pamsrvcmd.c @@ -1857,8 +1857,10 @@ getdomainrequesttype(struct pamauthreq preq, / By default, only POSIX domains are to be contacted / reqdomtype = CACHEREQPOSIXDOM; for (int i = 0; pctx->appservices[i]; i++) {

if (strcmp(pctx->appservices[i], preq->pd->service) == 0) { + for (int i = 0; pctx->appservices[i]; i++) { + if (preq->pd->service != NULL + && strcmp(pctx->appservices[i], + preq->pd->service) == 0) { reqdomtype = CACHEREQAPPLICATIONDOM; break; }

------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat