OESA-2026-4827: gssproxy security update
This is a proxy for GSSAPI which deals with credential handling Security Fix(es):
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.(CVE-2026-116497)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/gssproxyto a version that resolves this vulnerability.Fixed in 0.9.2-9.oe2403sp3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any local user that can send requests to the gssproxy Unix socket can trigger the crash. The malformed request does not require authentication.
What is the operational impact if exploitation succeeds?
The gssproxy daemon crashes and does not automatically restart, causing persistent denial of service. Dependent services, including Kerberized NFS and IdM, can also be affected.
How can I determine whether an attempted exploit occurred?
Look for a gssproxy daemon crash associated with a GSSX_INIT_SEC_CONTEXT request whose target_name field is absent. Affected systems may also show failures in services that depend on gssproxy.