SSSD EUVD-2026-40268

The following specific conditions must all be satisfied for exploitation: (1) SSSD must be deployed as the PAM authentication broker on the target RHEL system (RHEL 6-10 or OpenShift Container Platform 4); (2) smartcard or YubiKey authentication must be enabled in sssd.conf (typically via pam_cert_auth = True or equivalent certificate authentication configuration - this is non-default and must be explicitly enabled by an administrator); (3) the attacker must have local access to the system with high-privileged credentials (CVSS PR:H), limiting the attack surface to insiders, physical access scenarios, or attackers who have already achieved elevated local access by other means; (4) the attacker must be able to manipulate the contents of a YubiKey or smartcard device, implying either physical possession of the token or privileged access to YubiKey management tools. Exploitation is further constrained by AC:H, meaning race conditions or precise heap state control are required for anything beyond a crash. Remote unauthenticated exploitation is not possible given AV:L.

The CVSS 3.1 base score of 6.4 (Medium) reflects a real but tightly constrained threat. The vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H indicates local attack surface only, high attack complexity, and a requirement for high-privileged access - three compounding factors that substantially reduce real-world exploitability compared to the C:H/I:H/A:H impact metrics alone. In practice, an attacker already holding high privileges on a local RHEL host has less incentive to exploit a difficult use-after-free than to abuse their existing access. The privilege escalation path is explicitly described by the vendor as 'difficult to exploit,' and no EPSS data or CISA KEV listing is present to elevate urgency. No public exploit or proof-of-concept code has been identified. The primary realistic risk is denial of service to authentication services - SSSD crashing means no PAM authentication succeeds for any user until the service is restarted, which could be operationally significant in environments using SSSD as the sole authentication broker. Environments where operators routinely handle physical YubiKey/smartcard devices may face slightly elevated exposure from insider threats. Overall, this is a real but low-urgency issue: patch when available in normal maintenance cycles unless authentication availability is safety-critical.

A local operator or insider with high-privileged access on a RHEL host configured for YubiKey authentication crafts or modifies the contents of a YubiKey or smartcard to trigger a specific code path in the SSSD PAM responder. When the manipulated device is processed during an authentication attempt, the PAM responder dereferences a freed memory pointer, causing a crash and denying authentication to all users on the system. In a more sophisticated scenario, an attacker with detailed knowledge of SSSD's heap layout could attempt to control the freed memory region to redirect execution, but the vendor characterizes this privilege escalation path as difficult to achieve. No proof-of-concept code is publicly available to validate the escalation path.