Bug 2471741 (CVE-2026-73199)

AI_ONLY_REPORT
package: ipa-4.13.1-3.el10
------
Summary: NULL Pointer Dereference in `ipa-enrollment` Extended Operation  
(`JOIN_OID`) via Missing Request Value: in deployments using the  
`ipa-enrollment` SLAPI plugin from `ipa-4.13.1-3.el10`, a non-anonymous  
authenticated LDAP client can omit the request value for `JOIN_OID` and  
trigger a NULL pointer dereference in `ipa_join()`, leading to Directory  
Server denial of service.
Requirements to exploit: Reach a deployment built from `ipa-4.13.1-3.el10`  
where the `ipa-enrollment` SLAPI plugin is enabled, establish LDAP over a  
secure channel with SSF greater than 1, authenticate with a non-anonymous  
account, and send `JOIN_OID` without a request value.
Component affected: `ipa-4.13.1-3.el10`:  
`daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c`, `ipa_join()`  
via `ipaenrollment_extop()` handling of `JOIN_OID`
Version affected: `ipa-4.13.1-3.el10` in deployments where the  
`ipa-enrollment` SLAPI plugin is built and enabled
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM)
AV:N - The issue is reachable over the network through LDAP when the  
vulnerable plugin is exposed.
AC:L - The trigger is a simple malformed extended operation with the  
request value omitted.
PR:L - `ipa_join()` rejects anonymous binds before the dereference, so a  
non-anonymous authenticated account is required.
UI:N - No user interaction is needed once the attacker can send the LDAP  
request.
S:U - The impact is limited to the vulnerable directory service  
component.
C:N - No confidentiality impact is established from the available  
evidence.
I:N - No integrity impact is established from the available evidence.
A:H - The NULL dereference can crash the process or otherwise deny  
Directory Server availability, depending on runtime handling.
Impact: Important. This issue lets a remote authenticated client directly  
compromise service availability with low attack complexity by sending a  
malformed LDAP extended operation. That aligns with Red Hat's Important  
rating for flaws that allow remote denial of service, while falling short  
of Critical because exploitation requires authentication and no  
confidentiality, integrity, or code-execution impact is established.
Embargo: no
Reason: The established impact is authenticated denial of service only,  
with no demonstrated confidentiality or integrity exposure, and the  
remediation is a straightforward server-side input validation change.
Acknowledgement: Aisle Research
Vulnerability Details: `ipaenrollment_extop()` routes `JOIN_OID` requests  
into `ipa_join()` after OID and secure-connection checks. Inside  
`ipa_join()`, the code retrieves `SLAPI_EXT_OP_REQ_VALUE` and immediately  
dereferences `extop_value->bv_val` without verifying that the request value  
is present:
```c
/* Get the ber value of the extended operation */
slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
/* We are passed in the FQDN of the host to enroll. Do an internal
search and pull that entry.
  */
filter = slapi_ch_smprintf("(fqdn=%s)", extop_value->bv_val);
```


A non-anonymous authenticated caller that omits the request value can  
therefore reach a NULL pointer dereference before the function performs its  
internal search and before later enrollment ACL checks. Other extended  
operation handlers in the same source tree explicitly reject `NULL` or  
empty request values before use, which supports treating this as a  
reachable malformed-input case rather than a purely theoretical source  
defect. Based on the available evidence, the security impact established  
here is denial of service; the exact failure mode may vary with runtime  
handling.
Steps to reproduce:
1. Use a Directory Server deployment built from `ipa-4.13.1-3.el10` where  
the `ipa-enrollment` SLAPI plugin is enabled.
2. Connect to LDAP over a secure channel such as StartTLS or LDAPS so that  
the connection has SSF greater than 1.
3. Bind as a non-anonymous authenticated user, then send LDAP extended  
operation OID `2.16.840.1.113730.3.8.10.3` (`JOIN_OID`) with no request  
value.
4. Observe a server-side crash or equivalent denial-of-service condition  
when `ipa_join()` dereferences `extop_value->bv_val`.
Mitigation: Until a fixed package is available, restrict access to the  
enrollment extended operation to trusted authenticated clients only. Where  
host enrollment is not required, disabling the `ipa-enrollment` SLAPI  
plugin removes this attack surface. These measures reduce exposure but do  
not correct the missing NULL check.
Proposed Fix: Validate `extop_value` immediately after `slapi_pblock_get()`  
and reject missing or empty request values before building the internal  
search filter.
```diff
diff --git  
a/freeipa-4.13.1/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c  
b/freeipa-4.13.1/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
@@ -167,6 +167,14 @@ ipa_join(Slapi_PBlock *pb)
/* Get the ber value of the extended operation */
slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
+    if (extop_value == NULL || extop_value->bv_val == NULL ||  
extop_value->bv_len == 0) {
+        errMesg = "Missing or empty enrollment request value.\n";
+        rc = LDAP_PROTOCOL_ERROR;
+        goto free_and_return;
+    }
+
/* We are passed in the FQDN of the host to enroll. Do an internal
search and pull that entry.
       */
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use