Bug 2510309

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder (src/responder/nss/nss_protocol_grent.c) pre-allocates the reply packet for all group entries using sss_packet_grow() but does not shrink the packet when groups are skipped (non-POSIX, incomplete, or filtered groups). sss_packet_grow() uses talloc_realloc_size(), which does not zero-fill newly allocated memory. The trailing unwritten bytes therefore contain uninitialized heap data from the sssd_nss process and are transmitted to the client at the grown packet length. A local attacker can exploit this by sending SSS_NSS_INITGR (0x0026) requests to the world-writable NSS responder socket (/var/lib/sss/pipes/nss), receiving uninitialized heap content in the reply tail. Through heap grooming (for example, a preceding getpwnam query), the leak can disclose other users' cached directory records and process heap pointers. The leaked data is limited to the sssd_nss heap (directory-level information); credentials reside in separate sssd_pam and sssd_be processes. Reported via PSIRTSUPT-20553 by BreachX Zero Day Labs.