EUVD-2026-92895
GHSA-c66h-w9px-9v6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account access
-
ExploitSend malformed packet to autofs responder socket
-
ExecutionTrigger integer underflow and OOB read
-
ImpactCrash responder, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an interactive local account or local code execution on a host running SSSD with the autofs responder service enabled (the 'autofs' service configured in sssd.conf); the attacker must be able to connect to the autofs responder UNIX socket. Exploitation is limited by the need for prior local access (PR:L, AV:L) and by the autofs responder being active - hosts where SSSD's autofs responder is not enabled are not exposed. Impact is confined to a denial of service of the responder process; there is no remote vector and no confidentiality or integrity impact. |
| Impact | This is a moderate-severity, local denial-of-service issue that does not warrant emergency prioritization. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 MEDIUM) is internally consistent with the description: exploitation requires local access (AV:L) and a local account (PR:L) to reach the autofs responder UNIX socket, with impact limited strictly to availability (A:H) and no confidentiality or integrity loss (C:N/I:N). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a conflict between the CVSS metrics and the supplied tags: the 'Information Disclosure' tag contradicts C:N and the description, which describes only a crash/DoS from the out-of-bounds read - the OOB read terminates the process rather than returning attacker-readable data. Real-world risk is bounded by the local-only vector and the fact that the impact is a recoverable service crash (the responder can be restarted), not code execution or data exposure; the principal consequence is disruption of autofs/automount name resolution on the affected host. |
| Exploit ScenarioDerived | A local user (or a compromised low-privileged service account) on a Linux host running SSSD with the autofs responder enabled connects to the autofs responder UNIX socket and sends a specially crafted request declaring an invalid packet length. The integer underflow triggers an out-of-bounds read that crashes the responder, disrupting automount name resolution for all users on that host. No public proof-of-concept was included in the provided intelligence; attack complexity is low (AC:L) once local access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.
RemediationAI
No vendor-released patch version is identified in the provided data, so treat patch availability as unconfirmed and monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104037 and Bugzilla 2479030 for the relevant RHSA and fixed sssd package versions, then update sssd (and, for OpenShift, the RHCOS node image) and restart the sssd service. If the autofs responder is not required, remove 'autofs' from the 'services' line in sssd.conf (or set an explicit services list excluding it) and restart sssd; the trade-off is that automount map lookups served by SSSD will no longer work and autofs clients must fall back to local or file-based maps. Where autofs integration is required, harden the socket: verify the autofs responder socket under the SSSD runtime directory is owned by root with restrictive permissions (root/root, mode 0600 or equivalent) so that only privileged local users can connect, which mitigates the PR:L prerequisite at the cost of blocking non-root automount consumers, and rely on SELinux/AppArmor confinement of the sssd_autofs_t domain to prevent unprivileged writes to the socket. These measures reduce exposure but do not eliminate the underlying integer underflow, so patching remains the definitive fix once a vendor update is published.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SSSD (System Security Services Daemon) brokers access to remote identity and authentication sources and exposes per-service responders over UNIX domain sockets. The autofs responder, enabled via the 'autofs' value in the sssd.conf 'services' line, handles automount map requests from the local autofs client. In the affected code, a request carrying an invalid packet length is validated incorrectly, causing an integer underflow in the length calculation; the underflowed value is then used for a memory read, accessing data beyond the intended buffer boundary (CWE-125, out-of-bounds read). Because the responder runs as a long-lived process, the resulting fault crashes it and interrupts autofs lookups for all local users relying on it. The vulnerability is reachable only locally through the responder's socket, matching the assessed vector AV:L/PR:L/UI:N with availability-only impact; the CPE strings identify the affected platform packages as Red Hat Enterprise Linux 6, 7, 8, 9 and 10, plus Red Hat OpenShift Container Platform 4 (which carries SSSD in its RHEL CoreOS-based nodes), all without version granularity in the supplied data.
Know when Sssd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local socket access by an authenticated local user (AV:L/PR:L), low complexity, impact limited to crashing the responder (A:H) with no C/I effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Related Vulnerabilities in SSSD Multiple Security Flaws
View all 15A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cach
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, whic
Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Servic
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker wh
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS re
A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM res
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uid
Exploit-DB