CVE-2026-104043 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The System Security Services Daemon, commonly known as SSSD, serves as a critical component in Linux environments for managing identity and authentication. It acts as an intermediary between local services and remote identity providers such as Active Directory or LDAP servers. Within this architecture, the Name Service Switch responder plays a vital role by handling requests from applications that utilize the NSS interface to resolve user and group information. This specific vulnerability resides within the communication channel used by the NSS responder UNIX socket, which allows local processes to interact with SSSD services. The security flaw is characterized as an integer underflow condition triggered during the parsing of incoming packet headers. When a local attacker sends a specially crafted request containing an undersized packet header, the software fails to properly validate the length fields before performing arithmetic operations or memory allocation decisions based on those values.
This lack of rigorous input validation leads directly to an out-of-bounds memory read operation. As the responder process attempts to parse the malformed data structure, it accesses memory locations that are outside the bounds of the allocated buffer. This improper access violates standard memory safety principles and results in immediate instability within the application logic. The primary operational impact of this flaw is a Denial of Service condition. Because the out-of-bounds read corrupts the execution state or triggers an operating system protection mechanism, the SSSD responder process crashes. Since SSSD often runs as a privileged service responsible for authenticating users and managing access controls across the system, its sudden termination can disrupt authentication services for other local processes that depend on it. This effectively prevents legitimate users from logging in or accessing resources until the daemon is restarted by an administrator with appropriate privileges.
From a classification perspective, this vulnerability aligns closely with CWE-190, which describes integer underflow wraparound errors, and CWE-787, which covers out-of-bounds read vulnerabilities. The attack vector requires local access to the UNIX socket, meaning it is not remotely exploitable over a network but rather necessitates that an attacker has already gained some level of foothold on the host system or can execute code locally. This places the risk profile within the context of privilege escalation pathways where an unprivileged user might leverage this crash to cause service disruption as part of a broader attack strategy, although it does not directly grant higher privileges in itself. The behavior is also relevant to ATT&CK techniques involving resource hijacking and denial of service against local services, specifically those that impact system availability through process termination.
Mitigation strategies for this vulnerability primarily involve applying the vendor-provided patch or update that addresses the integer underflow condition within the SSSD package. System administrators should ensure that their systems are updated to a version where the packet header validation logic has been hardened to correctly check bounds before processing requests. In environments where immediate patching is not feasible, restricting access to the UNIX socket used by the NSS responder can serve as a temporary compensating control. This involves configuring file system permissions so that only trusted and necessary processes have read-write access to the socket path, thereby limiting the pool of potential local attackers who could attempt to trigger this flaw. Additionally, monitoring for unexpected restarts or crashes in SSSD-related services can help detect exploitation attempts early, allowing for rapid incident response before significant operational disruption occurs.