REDHAT-BUG-2572592: Null Pointer Dereference
A flaw was found in SSSD. In src/responder/pam/pamsrvcmd.c, pamforwarderparsedata() dereferences prctx->cliprotocolversion->version without first checking whether the client negotiated a protocol version with SSSGETVERSION. The pointer is initialized to NULL at connection setup and is only populated during version negotiation. A local user able to connect to the PAM responder socket can send a PAM command before SSSGETVERSION, causing a NULL pointer dereference and terminating sssdpam. Repeated requests can sustain denial of SSSD-backed authentication. The review describes a header-only 16-byte request reaching the vulnerable switch. The maintainer confirmed that recent versions do not initialize a non-NULL default and that rejecting requests when cliprotocolversion is NULL is a valid fix. A possible similar issue in sudosrvcmd() was noted by the maintainer but is not established as part of this flaw. This is distinct from CVE-2026-90995 (missing service item in getdomainrequesttype()) and CVE-2026-104042 (zero-length authentication token out-of-bounds read). Source: PSIRTSUPT-25890, finding H-09; security review dated 2026-10-21 and maintainer assessment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify pam_forwarder_parse_data() to reject PAM requests when prctx->cli_protocol_version is NULL, before dereferencing cli_protocol_version->version; require the client to negotiate a protocol version with SSS_GET_VERSION first.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who can connect to the SSSD PAM responder socket can trigger the failure. The impact is denial of service against SSSD-backed authentication rather than remote exploitation described by the available information.
What does an attacker need to send?
The attacker must send a PAM command before negotiating a protocol version with SSS_GET_VERSION. A header-only 16-byte request can reach the vulnerable code path and trigger the NULL pointer dereference.
What happens if the flaw is repeatedly triggered?
Each triggering request can terminate sssd_pam. Repeated requests can sustain a denial of SSSD-backed authentication.
Is a negotiated protocol version required before PAM commands are accepted safely?
Yes. The client protocol version pointer is NULL when a connection is established and is populated only after SSS_GET_VERSION negotiation; rejecting PAM requests while it is NULL is identified as a valid fix.