Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5_LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11_DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.

An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subsequent BIND triggers instant crash. Missed variant of CVE-2024-5953 which patched md5_pwd.c and pbkdf2_pwd.c but not smd5_pwd.c.

Present since smd5_pwd.c creation (~2005). PoC confirmed on Fedora 42 production binary.