OESA-2026-4713: sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA. Security Fix(es):
A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS).(CVE-2026-104029)
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).(CVE-2026-104031)
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).(CVE-2026-104037)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/sssdto a version that resolves this vulnerability.Fixed in 2.9.4-34.oe2403sp4
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Can these flaws be exploited remotely?
The provided information describes local exploitation. An attacker needs local access sufficient to send requests to the autofs responder UNIX socket; no remote attack path is stated.
Which systems are exposed to the memory-exhaustion issue?
CVE-2026-104031 affects configurations where the SSSD autofs responder service is enabled. The attacker must keep a client connection open and repeatedly submit valid requests to consume memory.
What is the practical impact of the crafted-request issue?
For CVE-2026-104029, a specially crafted request can trigger an out-of-bounds memory read and crash the autofs responder process. The stated impact is denial of service rather than confidentiality or integrity loss.