Bug 2479464 (CVE-2026-90995)

AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
------
Summary: Local DoS in PAM responder: NULL dereference in  
`get_domain_request_type()` when `SSS_PAM_ITEM_SERVICE` is omitted: a  
crafted local PAM protocol v2/v3 request that omits the service item can  
leave `pd->service` as `NULL` and trigger a NULL dereference in the PAM  
responder when `[pam] pam_app_services` is configured, causing denial of  
service.
Requirements to exploit: Local access sufficient to connect to the PAM  
responder socket and send a crafted PAM protocol v2/v3 request that omits  
`SSS_PAM_ITEM_SERVICE`; the target must use a non-empty `[pam]  
pam_app_services` configuration.
Component affected: `sssd-2.12.0-1.el10`, PAM responder code in  
`src/responder/pam/pamsrv_cmd.c`, specifically `pam_parse_in_data_v2()`,  
`pam_parse_in_data_v3()`, `pam_forwarder()`, and  
`get_domain_request_type()`.
Version affected: `sssd-2.12.0-1.el10`; reachability depends on a non-empty  
`[pam] pam_app_services` configuration.
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 5.5 (MEDIUM)
AV:L - The issue is reachable only from the local system through the PAM  
responder's UNIX socket.
AC:L - A valid request can be crafted without unusual conditions once  
the protocol framing and required fields are understood.
PR:L - The attacker needs local access equivalent to an unprivileged  
user that can submit requests to the PAM responder interface.
UI:N - No user interaction is required.
S:U - The crash affects the same security scope as the vulnerable  
responder.
C:N - No confidentiality impact was established.
I:N - No integrity impact was established.
A:H - A successful trigger can terminate the PAM responder and block  
authentication requests handled through it until the service recovers.
Impact: Moderate. This is an availability-only issue in a security-relevant  
local service, but exploitation is local and depends on a non-default yet  
supported `pam_app_services` deployment. That places it below Important  
under Red Hat guidance, while remaining above Low because the NULL  
dereference condition is concrete and can be triggered with a crafted  
request rather than being purely theoretical.
Embargo: no
Reason: Current evidence supports a local, configuration-dependent  
denial of service with straightforward mitigation and no demonstrated  
confidentiality, integrity, or privilege-escalation impact.
Acknowledgement: Aisle Research
Vulnerability Details: In PAM protocol v2/v3 request parsing,  
`SSS_PAM_ITEM_SERVICE` is optional, so the service pointer may remain unset:
```c
case SSS_PAM_ITEM_SERVICE:
ret = extract_string(&pd->service, size, body, blen, &c);
if (ret != EOK) return ret;
break;
```
The parsed request is then forwarded unconditionally into domain selection:
```c
preq->req_dom_type = get_domain_request_type(preq, pctx);
```
`get_domain_request_type()` compares configured application services  
against `preq->pd->service` without checking for `NULL`:
```c
for (int i = 0; pctx->app_services[i]; i++) {
if (strcmp(pctx->app_services[i], preq->pd->service) == 0) {
req_dom_type = CACHE_REQ_APPLICATION_DOM;
break;
}
}
```
When `[pam] pam_app_services` is non-empty and the request omits  
`SSS_PAM_ITEM_SERVICE`, the responder can reach `strcmp(nonnull, NULL)` and  
terminate with a NULL pointer dereference. The established impact from the  
available evidence is denial of service in the PAM responder. Relevant CWE:  
`CWE-476` (NULL Pointer Dereference).
Steps to reproduce:
1. Configure SSSD with a non-empty `[pam] pam_app_services` value, for  
example `pam_app_services = app_svc`, and restart the service.
2. Connect locally to the PAM responder socket. In standard builds this is  
the `SSS_PAM_SOCKET_NAME` path, commonly `/var/lib/sss/pipes/pam`.
3. Send a valid PAM protocol v3 request with correct  
`SSS_START_OF_PAM_REQUEST` / `SSS_END_OF_PAM_REQUEST` framing, a supported  
command such as `SSS_PAM_AUTHENTICATE`, and the fields needed for parser  
success, including `SSS_PAM_ITEM_CLI_PID` and a user or logon value.
4. Omit `SSS_PAM_ITEM_SERVICE` from the request.
5. Observe the request reach `get_domain_request_type()` and dereference  
`preq->pd->service == NULL` via `strcmp()`, causing the PAM responder  
process to crash.
Mitigation: Until a fix is applied, avoid configuring `pam_app_services`  
where it is not operationally required. If that setting must remain  
enabled, limit local ability to submit raw PAM responder requests as far as  
deployment policy allows and monitor for PAM responder crashes.
Proposed Fix: Add a NULL check before comparing `preq->pd->service` against  
entries in `pctx->app_services[]`. This preserves the existing  
application-domain selection behavior for valid service names while  
avoiding the NULL dereference on requests that omit `SSS_PAM_ITEM_SERVICE`.
```diff
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index <old>..<new> 100644
— a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -1857,8 +1857,10 @@ get_domain_request_type(struct pam_auth_req *preq,
/* By default, only POSIX domains are to be contacted */
req_dom_type = CACHE_REQ_POSIX_DOM;
   for (int i = 0; pctx->app_services[i]; i++) {

       if (strcmp(pctx->app_services[i], preq->pd->service) == 0) {
+    for (int i = 0; pctx->app_services[i]; i++) {
+        if (preq->pd->service != NULL
+                && strcmp(pctx->app_services[i],
+                          preq->pd->service) == 0) {
              req_dom_type = CACHE_REQ_APPLICATION_DOM;
              break;
          }
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use