REDHAT-BUG-2560642: Null Pointer Dereference
A NULL pointer dereference vulnerability was found in gssproxy's handling of GSSXINITSECCONTEXT requests. When a client sends this request with the optional targetname field marked absent, the daemon dereferences the resulting NULL pointer and crashes with SIGSEGV.
The request requires no authentication — any local user can send it via the gssproxy Unix socket, which is created with mode 0666 (world-accessible). The default shipped configuration (99-network-fs-clients.conf) uses allowanyuid=yes, meaning connections from any local uid are matched to a service and processed.
The gssproxy systemd unit has no Restart= directive, so once crashed the daemon stays down until manually restarted. All dependent services — including rpc-gssd (NFS Kerberos), nfsd, httpd via modauthgssapi, and IdM/FreeIPA — lose credential operations.
The defect is a missing NULL check at one call site in the initseccontext handler before passing targetname to a conversion function. Three other call sites in the codebase guard this same pointer before use, indicating the omission is an oversight.
Reported via PSIRTSUPT-26284 with a complete proof of concept and a two-line fix. Reproduced on gssproxy-0.9.2-10.el10 (RHEL 10.2) from an unprivileged local account.