Bug 2510305

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder (src/responder/pam/pamsrv_cmd.c) reads a 32-bit auth_token_length from the client request but does not validate it against the remaining buffer size before passing it to sss_authtok_set_password(). When sss_authtok_set_string() processes the token, it accesses str[len-1] using the unvalidated length, resulting in a heap-buffer-overflow read. A local attacker can trigger this by connecting to the world-writable PAM responder socket (/var/lib/sss/pipes/pam) and sending a crafted protocol v1 authentication request with an oversized auth_token_length value. The stock PAM client uses protocol v3, so this is only reachable via raw socket access. Protocol v2 includes an equivalent bounds check (*c+data_size > blen), which is missing from v1. Successful exploitation crashes the sssd_pam responder, causing a denial of service for SSSD-mediated authentication. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs.