Bug 2509761 (CVE-2026-68744)

Summary: CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2510309    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-31 12:31:32 UTC 
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder (src/responder/nss/nss_protocol_grent.c) pre-allocates the reply packet for all group entries using sss_packet_grow() but does not shrink the packet when groups are skipped (non-POSIX, incomplete, or filtered groups). sss_packet_grow() uses talloc_realloc_size(), which does not zero-fill newly allocated memory. The trailing unwritten bytes therefore contain uninitialized heap data from the sssd_nss process and are transmitted to the client at the grown packet length. A local attacker can exploit this by sending SSS_NSS_INITGR (0x0026) requests to the world-writable NSS responder socket (/var/lib/sss/pipes/nss), receiving uninitialized heap content in the reply tail. Through heap grooming (for example, a preceding getpwnam query), the leak can disclose other users' cached directory records and process heap pointers. The leaked data is limited to the sssd_nss heap (directory-level information); credentials reside in separate sssd_pam and sssd_be processes. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs.