CVE-2026-104037 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The System Security Services Daemon, commonly known as SSSD, serves as a critical component in Linux environments for managing identity and authentication. It provides access control to local and remote resources by integrating with various directory services such as LDAP, Active Directory, and Kerberos. Within this architecture, the autofs responder plays a specific role in handling automount requests from clients. This service listens on UNIX sockets for incoming mount operations, parsing request packets to determine which filesystems should be mounted based on predefined maps. The integrity of this packet processing logic is paramount because any failure can disrupt system functionality or expose underlying memory management flaws that attackers may leverage.
A significant vulnerability has been identified in the autofs responder component of SSSD, specifically involving the handling of incoming request packets over UNIX sockets. The core technical flaw lies in the validation and parsing of packet lengths provided by local clients. When a specially crafted request containing an invalid or malformed packet length is received, the software fails to properly validate this value before proceeding with memory allocation or access operations. This lack of rigorous input sanitization leads directly to an integer underflow condition during arithmetic calculations related to buffer sizes or offsets. Instead of rejecting the maliciously sized payload, the system proceeds to interpret the negative or excessively large resulting value as a valid memory address range.
This logical error triggers an out-of-bounds memory read operation. Because the calculated offset falls outside the allocated boundaries of the intended data structure, the responder process attempts to access memory locations that do not belong to its current execution context. In most operating system environments, such unauthorized memory access is detected by the kernel's memory protection mechanisms, resulting in a segmentation fault or similar fatal error. Consequently, the autofs responder process terminates abruptly. This crash effectively halts all automount operations managed by SSSD for that instance, leading to a denial of service condition where users and applications relying on automatic filesystem mounting are unable to access networked resources until the service is manually restarted.
The impact of this vulnerability is primarily confined to local attackers due to the nature of UNIX socket communication, which typically requires local system privileges or specific file permissions to connect. However, for any user with sufficient access rights to interact with the SSSD autofs responder socket, the ability to crash the service represents a serious availability risk. In environments where automounting is critical for operational continuity, such as large enterprise networks relying on centralized home directories or shared storage, this denial of service can cause significant workflow disruptions. Furthermore, while the immediate effect is a crash, out-of-bounds reads in C-based applications like SSSD are often precursors to more severe exploits if memory layout conditions allow information disclosure or code execution through subsequent write operations, although the current description emphasizes the denial of service aspect.
From a classification perspective, this vulnerability aligns with CWE-190, which describes integer overflow or wraparound errors that lead to out-of-bounds access. The specific mechanism involves an underflow resulting in invalid memory indexing, falling squarely within the domain of improper input validation and boundary checking failures. In terms of attack vectors, this flaw is associated with MITRE ATT&CK technique T1499, specifically endpoint denial of service via application crashes or resource exhaustion. It also relates to CWE-20, which covers improper input validation, as the root cause is the failure to verify that the packet length provided by the client falls within acceptable and safe limits before processing.
Mitigation strategies for this vulnerability focus on both immediate remediation and long-term architectural improvements. The primary defense is applying vendor-provided patches or updates to SSSD that correct the integer underflow logic in the autofs responder code. These updates typically include stricter validation checks to ensure packet lengths are positive, within expected bounds, and do not result in arithmetic errors during buffer calculations. Administrators should also enforce strict file permissions on UNIX sockets used by SSSD components to limit access only to authorized users and services, thereby reducing the attack surface for local exploitation. Additionally, implementing monitoring solutions that detect sudden process terminations or service unavailability can help identify potential abuse attempts early, allowing for rapid incident response before widespread disruption occurs.