Bug 2478980 (CVE-2026-104038)

AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
------
Summary: NULL Pointer Dereference in `expand_sid()` (`{sid}` / `{sid.rid}`)  
Can Crash SSSD in LDAPU1 Certmap Flows: a missing NULL check allows a  
certificate without Microsoft SID extension OID `1.3.6.1.4.1.311.25.2` to  
drive a NULL `sid_ext` into SID-based LDAPU1 certmap expansion and crash  
the SSSD certificate-mapping path.
Requirements to exploit: The deployment must use certificate mapping with  
an `LDAPU1` `maprule` that expands `{sid}` or `{sid.rid}`, and the attacker  
must be able to supply a syntactically valid certificate to that path. The  
certificate must omit OID `1.3.6.1.4.1.311.25.2`. The available evidence  
supports denial of service where certificate input is attacker-controlled;  
it does not establish broader impact.
Component affected: `sssd-2.12.0-1.el10`, certificate mapping in  
`src/lib/certmap/sss_certmap.c` (`expand_sid()` / `expand_template()`)  
together with SID extraction in `src/lib/certmap/sss_cert_content_crypto.c`  
(`get_sid_ext()`).
Version affected: `sssd-2.12.0-1.el10` when an `LDAPU1` certmap rule uses  
`{sid}` or `{sid.rid}`.
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 5.9 (MEDIUM)
AV:N - In deployments exposing certificate-authentication or  
certificate-lookup flows to remote clients, the attacker can reach the  
vulnerable mapping path over the network.
AC:H - Exploitation depends on a non-default but supported `LDAPU1`  
SID-based certmap rule and on a certificate that omits the SID extension.
PR:N - No prior privileges are required once the affected certmap flow  
is reachable.
UI:N - No victim interaction is required; the service evaluates the  
certificate automatically.
S:U - The crash affects the same SSSD security scope.
C:N - No confidentiality impact is established by the available evidence.
I:N - No integrity impact is established by the available evidence.
A:H - The NULL dereference can terminate the SSSD process handling  
certificate mapping, denying authentication or lookup service until  
recovery.
Impact: Moderate. Red Hat rates remote denial of service issues as  
Important when they can easily affect availability, but this case depends  
on a specific `LDAPU1` SID-based certmap configuration rather than a  
default or broadly expected setup. The evidence supports availability  
impact only, so Moderate is a better fit.
Embargo: no
Reason: This is a configuration-dependent denial of service with  
straightforward mitigation and a small, self-contained fix. The available  
evidence does not show confidentiality, integrity, or code-execution impact.
Acknowledgement: Aisle Research
Vulnerability Details: Certificate parsing can succeed even when the  
Microsoft SID extension is absent. In that case `get_sid_ext()` returns  
success without populating `sid_ext`, and `expand_template()` passes that  
pointer directly into `expand_sid()`. The materials most directly establish  
the crash path for `{sid.rid}` via `strrchr(NULL, '-')`. `{sid}` should be  
covered by the same guard because the same NULL `sid` is also passed into  
`talloc_strdup(ctx, sid)`. Supporting material indicates SID-based  
expansion is part of supported `LDAPU1` handling, so this is a reachable  
configuration path rather than dead code. Relevant CWE: `CWE-476`.
```c
static int expand_sid(struct sss_certmap_ctx *ctx, const char *attr_name,
const char *sid, char **expanded)
{
char *exp;
char *sep;
if (attr_name == NULL) {
exp = talloc_strdup(ctx, sid);
} else if (strcasecmp(attr_name, "rid") == 0) {
sep = strrchr(sid, '-');
if (sep == NULL || sep[1] == '\0') {
CM_DEBUG(ctx, "Unsupported SID string [%s].", sid);
return EINVAL;
}
exp = talloc_strdup(ctx, sep+1);
} else {
CM_DEBUG(ctx, "Unsupported attribute name [%s].", attr_name);
return EINVAL;
}
...
}
...
} else if (strcmp("sid", parsed_template->name) == 0) {
ret = expand_sid(ctx, parsed_template->attr_name,
cert_content->sid_ext, &exp);
}
...
idx = X509_get_ext_by_OBJ(cert, sid_ext_oid, -1);
ASN1_OBJECT_free(sid_ext_oid);
if (idx == -1) {
/* Extension most probably not available, no error. */
return 0;
}
```
Steps to reproduce:
1. Configure a certmap rule using LDAPU1 SID expansion, for example  
`maprule = LDAPU1:(objectsid={sid.rid})`.
2. Ensure that rule is exercised by a real certificate lookup or  
authentication path, such as PAM, LDAP, or proxy-backed cert mapping.
3. Present a syntactically valid certificate that does not contain OID  
`1.3.6.1.4.1.311.25.2`.
4. Trigger certificate mapping so `sss_certmap_get_search_filter()` or  
`sss_certmap_expand_mapping_rule()` evaluates the rule.
5. Observe the NULL dereference in `expand_sid()` and resulting process  
crash. The clearest reproduction is with `{sid.rid}`.
Mitigation: Until a fix is shipped, avoid `LDAPU1` certmap rules that  
expand `{sid}` or `{sid.rid}`. If SID-based mapping is required, reject  
certificates missing OID `1.3.6.1.4.1.311.25.2` before they reach the  
affected expansion path.
Proposed Fix: Add an early NULL check in `expand_sid()` and return an error  
when the SID extension is absent, so SID-based LDAPU1 mapping rules fail  
cleanly instead of dereferencing NULL.
```diff
diff --git a/src/lib/certmap/sss_certmap.c b/src/lib/certmap/sss_certmap.c
— a/src/lib/certmap/sss_certmap.c
+++ b/src/lib/certmap/sss_certmap.c
@@ -580,6 +580,11 @@ static int expand_sid(struct sss_certmap_ctx *ctx,  
const char *attr_name,
char *exp;
char *sep;
+    if (sid == NULL) {
+        CM_DEBUG(ctx, "SID extension is missing.");
+        return ENOENT;
+    }
+
if (attr_name == NULL) {
exp = talloc_strdup(ctx, sid);
} else if (strcasecmp(attr_name, "rid") == 0) {
```
------
This report was generated using AI technology. Always review AI-generated  
content prior to use