Summary
It was discovered that SSSD did not properly validate authentication token
lengths when processing PAM responder requests. A local attacker could
possibly use this issue to cause SSSD to crash, resulting in a denial of
service.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | sssd | 2.6.3-1ubuntu3.9 |
| Ubuntu · 24.04 LTS 24.04:LTS | sssd | 2.9.4-1.1ubuntu6.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | sssd | 2.12.0-1ubuntu5.4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | sssd | 1.13.4-1ubuntu1.15+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | sssd | 1.16.1-1ubuntu1.8+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | sssd | 2.2.3-3ubuntu0.13+esm1 |
Vulnerabilities 1
-
Medium 5.5
Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM …
References
-
report
https://ubuntu.com/security/CVE-2026-68743