Debian Patches
Status for sssd/2.13.1-5
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| fix-whitespace-test.diff | no | |||||
| default-to-socket-activated-services.diff | no | |||||
| fix-ftbfs-src-m4.diff | Avoid FTBFS due to unfound Makefile target src/m4.Abstract: Without this patch, the build aborts half-way with below error message ``` make[3]: *** No rule to make target 'src/m4', needed by 'all-am'. Stop. make[3]: *** Waiting for unfinished jobs.... ``` |
Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | no | |||
| fix-underlinking-keyutils.diff | Underlinking fixes for some unit tests (missing: -lkeyutils) | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | no | |||
| fix-eol-flaws-in-codefiles.diff | Fix EOL at EOF flaw to make src/test/whitespace_test happy | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | no | |||
| CVE-2026-12610.diff | PAM: fix use-after-free during p11_child processing `pam_check_cert_send()` stored `pctx->sss_certmap_ctx` in the request state. If `p11_refresh_certmap_ctx()` ran while `p11_child` was still executing (e.g. triggered by a domain refresh), it freed and replaced the certmap context, leaving the request state holding a dangling pointer. `p11_child_done()` could later use that pointer. Fix this by passing the `pam_ctx` into `pam_check_cert_send()` and dereferencing `pctx->sss_certmap_ctx` at the time it is actually needed in `p11_child_done()`, so the current context is always used. (cherry picked from commit fa7a55949a30fed064a28ea6f0c801fc5e8c5ba7) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-06-29 | ||
| CVE-2026-14474.diff | sudo: warn when ldap_sudo_search_base falls back to root DN When ldap_sudo_search_base is not explicitly configured, SSSD falls back to the domain's naming context (root DN) and searches the entire LDAP directory tree for sudoRole objects. Any LDAP principal with write access to any subtree can inject a sudoRole granting arbitrary sudo privileges on every enrolled host. This patch adds a warning log when the fallback occurs, alerting administrators that their configuration searches the entire directory tree for sudo rules. A future hardening step would be to default to ou=sudoers,<base_dn> instead of the root DN. The warning approach preserves backwards compatibility while ensuring administrators are aware of the security implications. Based on the patch by: Ian Murphy <imurphy@redhat.com> Amended by: Alexey Tikhonov <atikhono@redhat.com> :fixes: CVE-2026-14474 (cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-07-03 | ||
| CVE-2026-14476.diff | gpo: reject path traversal in gPCFileSysPath The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed by ad_gpo_extract_smb_components() which converts backslashes to forward slashes but does not reject ".." path traversal sequences. The resulting smb_path is used directly in gpo_cache_store_file() to construct a local filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO write access to write files outside the cache directory. Due to differential path resolution between libsmbclient (which clamps ".." at the SMB share root) and the kernel (which resolves ".." fully), the SMB download succeeds while the local file write escapes the cache. On systems with SELinux enforcing, this enables Kerberos configuration injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t, writable by sssd_t). On systems without SELinux, this enables arbitrary file writes including cron job injection for root code execution. This patch adds two layers of defense: 1. Reject ".." as a path component in smb_path at parse time in ad_gpo_extract_smb_components(). Uses component-aware validation that checks for "/..", "../", and exact ".." — not substring matching which would false-positive on legitimate names containing "..". 2. Validate the resolved cache path stays within GPO_CACHE_PATH in gpo_cache_store_file() using realpath(), with a trailing-slash prefix check to prevent prefix-collision attacks (e.g., /var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache). Based on the patch by: Ian Murphy <imurphy@redhat.com> Amended by: Alexey Tikhonov <atikhono@redhat.com> :fixes: CVE-2026-14476 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-07-02 | ||
| CVE-2026-68742.diff | nss: validate addrlen in sss_nss_protocol_parse_addr() :fixes: CVE-2026-68742 (cherry picked from commit 2839e8ccffebbb6bd605047b012eaa5fdb56b9d3) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-08-04 | ||
| CVE-2026-68743.diff | pam: validate auth_token_length in extract_authtok_v1() The check mimics one existing in `extract_authtok_v2()` :fixes: CVE-2026-68743 (cherry picked from commit bef9d12617f22335e65447609a2724a68c1bf68a) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-08-04 | ||
| CVE-2026-68744.diff | NSS: fix initgroups packet heap disclosure sss_nss_protocol_fill_initgr() pre-allocates the reply packet for all group entries in result->count, but groups may be skipped when they are non-POSIX, incomplete, or filtered by the negative cache. Shrink the packet after filling it so it contains exactly the data that was written. :fixes: CVE-2026-68744 (cherry picked from commit f5be5002a2e43ff9d2a22a95ffe4e0eeb56e0d3d) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-08-03 | ||
| gdm-51-pam-extension-macros-compat.diff | Fix FTBFS with GDM 51 PAM extension headers GDM 51 rewrote its gdm-pam-extensions headers, replacing the uppercase function-like macros with static inline functions. |
Renan Rodrigo <rr@ubuntu.com> | yes | 2026-08-12 | ||
| CVE-2026-80048-1.diff | KCM: set the client fd non-blocking to avoid event-loop hangs The listening socket fd is non-blocking, but accept() does not propagate that flag to the accepted connection. KCM issues several I/O syscalls within a single tevent callback (read the length header then the body in kcm_recv_data(); write the length, retcode and payload in kcm_send_data()). A tevent event only guarantees the first syscall can make progress without blocking, so on a blocking fd a client that sends the 4-byte length header and withholds the body blocks readv() and hangs the entire single-threaded KCM responder event loop. Set the accepted fd non-blocking in kcm_connection_setup() so an incomplete transfer surfaces as EAGAIN and is retried on the next event. :fixes: CVE-2026-80048 |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-01 | ||
| CVE-2026-80048-2.diff | KCM: allocate body buffer only once Now that kcm_iovec_op() correctly returns EAGAIN on a partial body read, kcm_recv_data() is re-entered to resume the transfer. It re-allocated the body buffer on every entry, pointing v_msg.kiov_base at the new allocation while leaving nprocessed untouched: the previous partially-filled buffer was orphaned (a per-retry leak) and the already-read prefix of the new buffer was left uninitialized, corrupting the assembled message. Allocate the buffer only when kiov_base is still NULL, so re-entries keep filling the same allocation. Related to: CVE-2026-80048 |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-01 | ||
| CVE-2026-80048-3.diff | KCM: reject request bodies smaller than the protocol header kcm_recv_data() validated only the upper bound of the attacker-controlled body length, accepting any value down to zero. A body shorter than the 4-byte protocol header (major, minor, opcode) can never be a valid KCM message, yet it was allocated, read, and only rejected deep in kcm_input_parse(). Reject msglen < KCM_MSG_HEADER_SIZE up front, before any allocation. The SAFEALIGN_*_CHECK macros already prevent out-of-bounds reads, so this is defense-in-depth and earlier, cheaper rejection. |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-01 | ||
| CVE-2026-80048-4.diff | KCM: add kcm_recv_timeout to avoid stuck requests This adds a new undocumented kcm "recv_timeout" option (defaults to 5s) and a timer on incoming request - the request payload must be read within the given time, otherwise the client connection is killed. Note that we can not just shorten the client_idle_timeout as that would prevent client reconnecting on interactive cli applications. See: 00ae18dc9fd05a0dd12043d50a7fc0f1123bbc85 Related to: CVE-2026-80048 |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-23 | ||
| CVE-2026-87853.diff | IDP: fix user matching in `eval_access_token_buf()` Make sure it is exact, not merely a prefix match. :fixes: CVE-2026-87853 (cherry picked from commit f3a324918c1a35bd0195a1de5b17897a0d3b6274) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-09 | ||
| CVE-2026-88252.diff | responder: back off accept() on fd exhaustion to stop busy-spin accept_fd_handler() did not inspect errno on accept() failure. When accept() failed with EMFILE/ENFILE (process/system out of file descriptors), the persistently registered listening fd (rctx->lfde) stayed readable and, with a non-empty listen backlog, the event loop re-fired the handler immediately, failing again forever. This busy-spin pegs a CPU and stalls the responder, a local DoS reachable by any user via the NSS/PAM sockets. On EMFILE/ENFILE, disable readability on the listening fd (TEVENT_FD_NOT_READABLE) and schedule a one-shot tevent timer (parented under accept_fd_ctx, guarded against double-scheduling) that re-enables it (TEVENT_FD_READABLE) after a bounded exponential backoff (200ms, doubling, capped at 5s, reset on the next successful accept). If the timer cannot be allocated, readability is re-enabled immediately so the listener never becomes permanently deaf. errno is saved before DEBUG(). Other accept() errors and the successful path are unchanged. :fixes: CVE-2026-88252 |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-13 | ||
| CVE-2026-90462.diff | LDAP: fix fail-open in ppolicy access check on zero results In `sdap_access_ppolicy_step_done()` a base-scoped ppolicy search that returned zero entries logged "Denying access" but left `locked` as false, so the common tail returned EOK and cached an "allow" decision. This let a deleted or deprovisioned but cached on the host user keep passing access checks. Set `locked = true` for the num_results < 1 case so the request is denied and the deny decision is cached, consistent with the analogous handling in `sdap_access_filter_done()`. :fixes: CVE-2026-90462 Commit message Assisted-By: Claude Code (Opus 4.8) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-23 | ||
| CVE-2026-90994.diff | PAM: fix out-of-bounds read in v1 request parser pam_parse_in_data() computed "last = blen - 1" before validating blen, so an empty body (blen == 0) underflowed last to SIZE_MAX and the string parsing loops read past the buffer. A truncated body could likewise advance "end" to blen, making the next "body[end++]" terminator check read one byte out of bounds. A local client negotiating protocol v1 could send such a malformed request and crash the PAM responder (local DoS). Reject bodies smaller than the v1 minimum up front (matching the style of pam_parse_in_data_v2()) and bounds-check "end" before each terminator dereference. :fixes: CVE-2026-90994 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-23 | ||
| CVE-2026-90996.diff | NSS: reject empty request body before body[blen - 1] access Header-only NSS requests yield blen == 0, causing a size_t underflow in the request parsers that read body[blen - 1]. Guard `parse_name()`, `parse_svc_name()`, `parse_svc_port()`, `parse_cert()` and `parse_sid()` against an empty body. :fixes: CVE-2026-90996 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-23 | ||
| CVE-2026-90463-1.diff | NSS: factor request body validation into a helper Replace the copy&pasted "get body, reject empty/short, check NULL termination" preamble in the NSS request parsers with a single `sss_nss_get_input_body()` helper taking a minimum length and a terminator flag. Used by `parse_name()`, `parse_name_ex()`, `parse_svc_name()`, `parse_svc_port()`, `parse_cert()`, `parse_sid()` and `parse_addr()`; the exact-length parsers `parse_id()`/`parse_id_ex()` keep their own checks. Implementation assisted-by: Claude Code (Opus 4.8) |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-23 | ||
| CVE-2026-90463-2.diff | NSS: bound service parser reads to the request body length `sss_nss_protocol_parse_svc_port()` and `sss_nss_protocol_parse_svc_name()` only required a single terminating NULL, then read past it: svc_port copied an 8-byte header and scanned the protocol string without ensuring the body was that long, and svc_name scanned the protocol field with no upper bound when the body held no second terminator. A crafted GETSERVBYPORT/GETSERVBYNAME request from a local client could therefore read beyond the packet body and crash the NSS responder. Require the full fixed header plus the protocol terminator in svc_port, and bound the protocol scan by blen in svc_name. Also correct the stale GETSERVBYPORT request layout comment (the header is 8 bytes, not 16). :fixes: CVE-2026-90463 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-23 | ||
| CVE-2026-90995.diff | PAM: avoid NULL deref when service item is missing SSS_PAM_ITEM_SERVICE is optional in the v2/v3 client protocol, so pd->service may be NULL. A crafted request omitting it triggered a NULL dereference in get_domain_request_type() when pam_app_services is configured, crashing the PAM responder (local DoS). Return the POSIX default when service is unset, and guard the debug log too. :fixes: CVE-2026-90995 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-09-23 | ||
| CVE-2026-104031.diff | autofs: free per-request context on successful replies :fixes: CVE-2026-104031 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-10-15 | ||
| CVE-2026-104032.diff | autofs: add 'allowed_uids' option to the autofs responder and make its default to be "0" so that only automount can connect :fixes: CVE-2026-104032 :config: 'autofs' responder now supports `allowed_uids` config option that defaults to "0" |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-10-15 | ||
| CVE-2026-104033.diff | Treat shadowExpire=0 correctly shadowExpire can be set to 0, representing the beginning of the Unix epoch. An account with shadowExpire set to 0 should be treated as expired. :fixes: CVE-2026-104033 |
Tomas Halman <thalman@redhat.com> | no | 2026-10-12 | ||
| CVE-2026-104036.diff | nfs idmap: error out if buffer is too small Although SSSD's NFS idmap plugin checks the buffer size it does not error out immediately if the buffer is too small. This patch fixes this. :fixes: CVE-2026-104036 |
Sumit Bose <sbose@redhat.com> | no | 2026-10-07 | ||
| CVE-2026-104038.diff | certmap: check that SID exists in certificate We have to check that SID is not NULL before using it in mapping rule. :fixes: CVE-2026-104038 |
Tomas Halman <thalman@redhat.com> | no | 2026-10-08 | ||
| CVE-2026-104039.diff | PAM: clear state pointer before freeing state itself :fixes: CVE-2026-104039 |
Tomas Halman <thalman@redhat.com> | no | 2026-10-09 | ||
| CVE-2026-104042.diff | pam: guard against zero-length string auth tokens :fixes: CVE-2026-104042 |
Justin Stephenson <jstephen@redhat.com> | no | 2026-10-12 | ||
| CVE-2026-104043.diff | nss: guard against length underflow in packet :fixes: CVE-2026-104043 |
Justin Stephenson <jstephen@redhat.com> | no | 2026-10-13 | ||
| CVE-2026-104044-pre.diff | fix potential memory leak | tong_1001 <sxt1001@qq.com> | no | 2026-09-04 | ||
| CVE-2026-104044.diff | pam: prevent null dereference in kerberos passkey flow :fixes: CVE-2026-104044 |
Justin Stephenson <jstephen@redhat.com> | no | 2026-10-12 | ||
| CVE-2026-104045.diff | autofs: avoid leaked enumeration contexts after map :fixes: CVE-2026-104045 |
Justin Stephenson <jstephen@redhat.com> | no | 2026-10-13 | ||
| CVE-2026-104046.diff | IDP: Clean old items from open_request_table :fixes: cve-2026-104046 |
Tomas Halman <thalman@redhat.com> | no | 2026-10-15 | ||
| CVE-2026-104047.diff | oidc_child: escape single quotes in Entra ID OData filters The Entra ID lookup path interpolated unsanitized lookup names into single-quoted OData $filter string literals. A local user could embed a single quote in an NSS lookup name to break out of the literal and inject arbitrary filter logic, enabling overbroad Microsoft Graph directory queries. Transport-layer URL encoding does not prevent this because the Graph server URL-decodes the filter value before parsing it as OData. Escape every embedded single quote by doubling it (OData convention) before building the filter, applied independently to the input and the derived short name at all five interpolation sites. :fixes: CVE-2026-104047 |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-13 | ||
| CVE-2026-104048.diff | ipa: compare users with domain awareness against HBAC rules HBAC reduced both the request-side and rule-side user identities to bare shortnames before comparison, discarding the domain. In trust-enabled IPA deployments this let a trusted-domain user whose shortname collided with an IPA-local user named in an HBAC allow rule satisfy that rule, bypassing the intended authorization boundary. Preserve the fully-qualified internal name (user@domain) on both SSSD call sites instead of stripping it to the shortname: - hbac_eval_user_element() (ipa_hbac_common.c): store the already domain-qualified username directly in users->name. - hbac_user_attrs_to_rule() (ipa_hbac_users.c): store the already internal-fqname-formatted SYSDB_NAME directly in new_users->names[]. :fixes: CVE-2026-104048 |
Pavel Březina <pbrezina@redhat.com> | no | 2026-10-13 | ||
| CVE-2026-104041_pre_NSS-Add-options-to-exclude-UID-and-GID.diff | NSS: Add options to exclude UID and GID :feature: UIDs and GIDs mentioned in the new options filter_uids and filter_gids will make SSSD avoid the LDAP search and just say that they don't exist. They are comma-separated lists of simple values or ranges: filter_uids = 0-999, 1234, 2000-2099 |
Alejandro López <allopez@redhat.com> | no | 2026-10-20 | ||
| CVE-2026-104041-1.diff | negcache: replace selective resets with a single recreate helper Drop sss_ncache_reset_{permanent,users,groups}() and their tdb_traverse delete callbacks in favor of sss_ncache_reset(), which recreates the in-memory tdb from scratch and repopulates the permanent entries. Both the domain-refresh and the NSS clearNegcache paths now use it. |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-10-30 | ||
| CVE-2026-104041-2.diff | RESPONDER SBUS: get rid of `-sss_resp_reset_ncache_*` and `sss_ncache_get_timeout()`. Those aren't used. Getting rid of it will allow further simplification. |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-10-30 | ||
| CVE-2026-104041-3.diff | negcache: limit max mem size consumed by negative cache :fixes: CVE-2026-104041 |
Alexey Tikhonov <atikhono@redhat.com> | no | 2026-11-02 | ||
| CVE-2026-92821.diff | ldap: pwd_expire_policy_warn does not overwrite errors Make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors. :fixes: CVE-2026-92821 |
Sumit Bose <sbose@redhat.com> | no | 2026-09-25 |
All known versions for source package 'sssd'
- 2.13.1-5 (sid)
- 2.13.1-4 (forky)
- 2.10.1-2+deb13u1 (trixie-proposed-updates)
- 2.10.1-2 (trixie)
- 2.8.2-4+deb12u1 (bookworm)