A NULL pointer dereference vulnerability was found in gssproxy's handling of GSSX_INIT_SEC_CONTEXT requests. When a client sends this request with the optional target_name field marked absent, the daemon dereferences the resulting NULL pointer and crashes with SIGSEGV.

The request requires no authentication — any local user can send it via the gssproxy Unix socket, which is created with mode 0666 (world-accessible). The default shipped configuration (99-network-fs-clients.conf) uses allow_any_uid=yes, meaning connections from any local uid are matched to a service and processed.

The gssproxy systemd unit has no Restart= directive, so once crashed the daemon stays down until manually restarted. All dependent services — including rpc-gssd (NFS Kerberos), nfsd, httpd via mod_auth_gssapi, and IdM/FreeIPA — lose credential operations.

The defect is a missing NULL check at one call site in the init_sec_context handler before passing target_name to a conversion function. Three other call sites in the codebase guard this same pointer before use, indicating the omission is an oversight.

Reported via PSIRTSUPT-26284 with a complete proof of concept and a two-line fix. Reproduced on gssproxy-0.9.2-10.el10 (RHEL 10.2) from an unprivileged local account.