CVE-2026-68742 in Red Hat
Summary
by MITRE • 08/03/2026
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability resides within the System Security Services Daemon SSSD implementation specifically in the NSS responder module where the sss_nss_protocol_parse_addr() function fails to properly validate input parameters against the actual packet data structure. This flaw represents a classic buffer over-read condition that occurs when the addrlen field is not adequately checked against the remaining packet body size, creating a scenario where memory access extends beyond allocated boundaries. The issue manifests through the NSS (Name Service Switch) responder socket which handles GETHOSTBYADDR requests, a common operation in network name resolution services.
From a technical perspective this vulnerability stems from inadequate input validation and bounds checking mechanisms within the protocol parsing logic. The sss_nss_protocol_parse_addr() function processes network packets containing address information but does not perform proper size validation before attempting to read data from the packet buffer. When an attacker crafts a malicious GETHOSTBYADDR request with a manipulated addrlen field, the function proceeds to read memory locations that may not be part of the legitimate packet payload, leading to out-of-bounds memory access patterns that typically result in segmentation faults or process termination.
The operational impact of this vulnerability extends beyond simple denial of service as it provides local attackers with a reliable method to crash the NSS responder process and potentially disrupt system services that depend on name resolution. This affects systems where SSSD is configured to handle network name lookups through NSS modules, particularly in enterprise environments where centralized authentication and authorization services rely heavily on proper name resolution functionality. The vulnerability can be exploited without requiring elevated privileges, making it particularly concerning for local attack scenarios where an attacker already has access to the system but seeks to cause disruption or gain additional leverage.
Security implications align with CWE-129 and CWE-787 which address insufficient input validation and out-of-bounds read conditions respectively. The vulnerability also maps to ATT&CK technique T1499.004 for network denial of service attacks, where adversaries exploit weaknesses in system services to disrupt availability. Mitigation strategies should include immediate patching of SSSD components, implementing proper bounds checking in protocol parsers, and deploying monitoring solutions that can detect unusual patterns in NSS responder socket activity. System administrators should also consider restricting local access to NSS responder sockets and implementing proper input sanitization measures within the service configuration to prevent malformed packet processing from causing system instability.