Bug 2494772 - CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
Summary: CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information le...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: 389-ds-base
Version: rawhide
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: mreynolds
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["8967e51f-8ebb-4767-837e-d...
Depends On:
Blocks: CVE-2026-11785
TreeView+ depends on / blocked
 
Reported: 2026-06-30 07:23 UTC by Samuele Negrini
Modified: 2026-06-30 07:23 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:
fedora-admin-xmlrpc: mirror+

Attachments (Terms of Use)

Description Samuele Negrini 2026-06-30 07:23:18 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A type confusion bug in extop_handle_ldapssotoken_request() (extendop.c) passes a stack pointer (&rc) to ber_printf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.

Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). PoC confirmed on Fedora 42: INTEGER=0x8e7faed8 leaked. Reduces stack ASLR entropy but is not a full bypass.
Note You need to log in before you can comment on or make changes to this bug.