Found By

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC DUMP replies to a client application that uses the pmap getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

**Name of the Vulnerable Software and Affected Versions** flatpak-builder (affected versions not specified) **Description** A flaw in flatpak-builder allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. This allows sensitive host files accessible to the build process to be read and incorporated into the build artifacts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause a memory leak, leading to excessive memory consumption that can disrupt or crash the autofs service. A race condition occurs when the timing or order of events affects the correctness of the software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw in the autofs responder allows an unprivileged local user to repeatedly request master automount map updates because of missing authorization checks. This action triggers global cache invalidation and forces continuous lookups to backend directory providers, resulting in a Denial of Service (DoS) characterized by degraded automount availability and high resource consumption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** An issue exists when SSSD is configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes. The system fails to recognize an expiration value of zero as an expired account. Consequently, a user with valid credentials for an account that should be expired can bypass access controls and authenticate to the system, allowing unauthorized access to persist after the account was intended to be deactivated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw exists in SSSD when the autofs responder service is enabled. Memory allocated during the processing of successful requests is not released until the client connection is terminated. A local attacker can cause memory exhaustion and a Denial of Service (DoS) by maintaining an open connection and repeatedly submitting valid requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw in the Kerberos Credential Manager (KCM) responder allows a local user to trigger a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. The service fails to release cached objects from memory during the removal of credentials, leading to continuous memory growth that exhausts available system resources and renders the service unresponsive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw exists in the SSSD NFS idmap plugin. When retrieving cached user or group names, the plugin identifies if an entry exceeds the destination buffer size but continues to copy data instead of aborting. A local attacker can trigger an out-of-bounds write by requesting identity lookups that resolve to oversized cached entries. This typically results in a Denial of Service (DoS) by crashing the identity mapping service and may lead to the corruption of adjacent process memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw in SSSD allows a local attacker to cause a denial of service (DoS) by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This action triggers an integer underflow—a condition where a subtraction results in a value smaller than the minimum representable value—and an out-of-bounds memory read, leading to a crash of the responder process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sssd (affected versions not specified) **Description** A flaw exists where a remote attacker can trigger a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In environments using SID-based certificate mapping rules, the service does not verify the presence of the extension before processing, leading to a process crash during lookup or authentication operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw exists in SSSD when configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments. In this configuration, an expired-password warning causes the system to terminate rule evaluation prematurely and treat the access request as successful. A remote authenticated user with an expired password who utilizes an alternative authentication method, such as SSH public key authentication, can exploit this behavior to bypass access control restrictions and gain unauthorized access to protected systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A local user can cause a denial of service (DoS) by disrupting system authentication services. The issue occurs during the handling of Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, where cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, leading the service to access invalid memory and terminate unexpectedly. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** An OData injection flaw exists when SSSD is configured with the Entra ID identity provider. Input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this by submitting a crafted search request to alter query filters and broaden user or group searches. This may result in information disclosure through the retrieval of unintended directory objects or a Denial of Service (DoS) caused by excessive processing and cache population. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sssd (affected versions not specified) **Description** A flaw in sssd allows a local attacker to cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request to the responder socket. The request contains a zero-length authentication token which, due to missing input validation, triggers an out-of-bounds read (reading data beyond the allocated buffer boundaries), resulting in a crash of the PAM responder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw in the Name Service Switch (NSS) responder allows an unprivileged local user to trigger a Denial of Service (DoS) by repeatedly requesting lookups for nonexistent entries. The negative cache, which stores results of failed lookups, does not limit the total number of entries and only removes expired records when an existing key is rechecked. This causes the cache to grow without bound, leading to memory exhaustion and causing the responder to become unresponsive or terminate. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A flaw in SSSD allows a local attacker with access to the Name Service Switch (NSS) responder UNIX socket to trigger an integer underflow. By sending a specially crafted request with an undersized packet header, the attacker causes an out-of-bounds memory read during packet parsing. This leads to the crash of the responder process, resulting in a Denial of Service (DoS). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sssd (affected versions not specified) **Description** A flaw in sssd allows a local attacker to cause a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request while passkey authentication is active. The issue stems from a missing state validation check during passkey Kerberos handling, which leads the PAM responder to dereference an uninitialized pointer and crash, thereby disrupting authentication services on the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** When configured to use Microsoft Entra ID, SSSD fails to properly sanitize search inputs before incorporating them into directory query filters. A local user can exploit this by submitting a crafted lookup request to manipulate the query logic, leading to unauthorized information disclosure from the directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المصاب والإصدارات المتأثرة** SSSD (إصدارات متأثرة غير محددة) **Description** يوجد خلل من نوع use-after-free في مستجيب Kerberos Credential Manager (KCM) أثناء تجديد تذكرة منح التذاكر (TGT) الخاصة بـ Kerberos. يحدث هذا عندما يقوم استدعاء عكسي مؤجل بالوصول إلى ذاكرة تم تحريرها بالفعل. يمكن لمستخدم محلي مصرح له يمتلك تذكرة Kerberos قابلة للتجديد إثارة هذه المشكلة في الأنظمة المهيئة لتجديد KCM، مما يؤدي إلى تعطل خدمة مستجيب KCM وبالتالي حدوث حالة حجب الخدمة (DoS). **Recommendations** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.