CVE-2026-90994 in Red Hat
Summary
by MITRE • 09/14/2026
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in System Security Services Daemon (SSSD) resides within the Pluggable Authentication Modules (PAM) responder component, specifically affecting the protocol version one parser function known as pam_parse_in_data. SSSD is a critical system daemon used on Linux and Unix-like operating systems to provide access to remote directory services and authentication mechanisms. The PAM responder acts as an intermediary that processes authentication requests from local applications via UNIX sockets. This specific flaw arises when the parser fails to adequately validate the length or completeness of incoming data structures before attempting to read them, creating a scenario where malformed input can lead to unsafe memory operations.
The technical nature of this vulnerability is classified as an out-of-bounds read, which corresponds to CWE-125 in the Common Weakness Enumeration standard. The exploit mechanism requires a local client that possesses access to the PAM responder's UNIX socket. By negotiating protocol version one and subsequently sending a request body that is either empty or truncated, the attacker triggers a condition where the parser attempts to read memory beyond the allocated buffer boundaries. This occurs because the code does not sufficiently check if the received data length matches the expected structure size before processing it. The out-of-bounds read itself may result in reading uninitialized memory or sensitive information from adjacent heap regions, but more immediately, it causes instability within the responder process.
The operational impact of this vulnerability is primarily a local denial of service against the authentication infrastructure. When the PAM responder encounters the malformed request and triggers the out-of-bounds read, the SSSD daemon typically crashes or terminates unexpectedly to prevent further corruption. Since SSSD manages user sessions and authentication for multiple services on the system, its termination disrupts ongoing login processes and prevents new local users from authenticating successfully until the service is restarted by an administrator or automated recovery mechanism. This effectively locks out legitimate users who rely on network-based identity sources managed by SSSD, thereby degrading system availability without requiring elevated privileges to execute the initial exploit, provided only socket access is available.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1059, specifically sub-techniques related to command and script interpreters or local process manipulation if used in conjunction with other exploits for privilege escalation, though its primary classification here remains as a denial of service vector via input validation failure. The attack surface is limited to the local environment because exploitation depends on access to the UNIX socket, which typically requires user-level permissions within specific groups such as sssd or root depending on system configuration. However, in multi-tenant environments or systems where untrusted users have shell access and can interact with SSSD sockets, this flaw presents a significant risk to service continuity.
Mitigation strategies should focus on applying the vendor-provided patches that address the input validation logic within pam_parse_in_data(). Administrators must ensure that their SSSD packages are updated to versions where protocol version one requests are strictly validated for length and completeness before parsing begins. Additionally, hardening measures such as restricting access to the SSSD UNIX sockets through proper file system permissions can limit the attack surface to only trusted users or services. Monitoring logs for unexpected restarts of the sssd service may also serve as an early detection mechanism for attempted exploitation activities in environments where patching cannot be immediately applied.