CVE-2026-68743
Fixed in a distro release EPSS <1%CVSS 5.5
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sssd | no fix |
| Debian 13 | sssd | no fix |
| SUSE Linux Enterprise Micro 5.3 | sssd | 2.5.2-150400.4.51.1 |
| SUSE Linux Enterprise Micro 5.4 | sssd | 2.5.2-150400.4.51.1 |
| SUSE Linux Enterprise Micro 5.5 | sssd | 2.5.2-150500.10.49.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | sssd | 2.10.2-150700.9.40.1 |
| SUSE Linux Enterprise Server 16.0 | sssd | 2.10.2-160000.5.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | sssd | 1.16.1-7.79.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | sssd | 2.10.2-160000.5.1 |
| SUSE Linux Micro 6.0 | sssd | 2.8.2-10.1 |
| SUSE Linux Micro 6.1 | sssd | 2.9.5-slfo.1.1_7.1 |
| SUSE Linux Micro 6.2 | sssd | 2.10.2-160000.5.1 |
| Ubuntu 22.04 LTS | sssd | 2.6.3-1ubuntu3.9 |
| Ubuntu 24.04 LTS | sssd | 2.9.4-1.1ubuntu6.8 |
| Ubuntu 26.04 LTS | sssd | 2.12.0-1ubuntu5.4 |
| Ubuntu Pro 16.04 LTS | sssd | 1.13.4-1ubuntu1.15+esm1 |
| Ubuntu Pro 18.04 LTS | sssd | 1.16.1-1ubuntu1.8+esm1 |
| Ubuntu Pro 20.04 LTS | sssd | 2.2.3-3ubuntu0.13+esm1 |
| openSUSE Leap 16.0 | sssd | 2.10.2-160000.5.1 |