Description
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).
Published: 2026-10-06
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Implement Workaround
AI Analysis

Impact

A flaw in SSSD allows a local attacker to send a crafted request to the autofs responder UNIX socket containing an invalid packet length. The request triggers an integer underflow, followed by an out‑of‑bounds memory read, which causes the responder process to crash and results in a denial of service. The weakness is classified as CWE-125: Out‑of‑Bounds Read.

Affected Systems

Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat OpenShift Container Platform 4, are affected. The vulnerability is present in all of the listed Red Hat products that include the SSSD component.

Risk and Exploitability

The CVSS score is 5.5, indicating a moderate severity. No EPSS score is available, and the vulnerability is not included in the CISA KEV catalog. Attacks appear to be local and require the ability to send requests to the autofs responder socket. The impact is primarily a denial of service against automount operations; it does not directly compromise data confidentiality or integrity, but it can disrupt identity lookups and applications that depend on automount. The lack of an official patch means that the only current mitigation is the documented workaround.

Generated by OpenCVE AI on October 6, 2026 at 01:22 UTC.

Remediation

Vendor Workaround

If SSSD automount map integration is not required, disable the autofs responder. Stop and mask the socket-activated service: # systemctl stop sssd-autofs.socket sssd-autofs.service # systemctl mask sssd-autofs.socket If 'autofs' is explicitly listed in the services directive under the [sssd] section of /etc/sssd/sssd.conf, remove it and restart the SSSD service: # systemctl restart sssd If autofs support is required, restrict access to the autofs responder UNIX socket (typically /var/lib/sss/pipes/autofs) to trusted local users. Note that disabling the autofs responder prevents SSSD from resolving automount maps, and restarting SSSD may temporarily disrupt identity lookups and active automount operations.

OpenCVE Recommended Actions

  • Stop and mask the autofs responder services using systemctl stop sssd-autofs.socket sssd-autofs.service and systemctl mask sssd-autofs.socket
  • Edit /etc/sssd/sssd.conf, remove autofs from the services directive under the [sssd] section, then restart SSSD with systemctl restart sssd
  • If automount map integration is not required, keep the responder disabled; otherwise, evaluate alternative methods or await an official patch

Generated by OpenCVE AI on October 6, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Sssd
Sssd sssd
Vendors & Products Redhat openshift Container Platform
Sssd
Sssd sssd

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 06 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).
Title Sssd: sssd: denial of service via packet length underflow in autofs responder
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-125
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux Openshift Openshift Container Platform
Sssd Sssd
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-16T10:57:40.247Z

Reserved: 2026-10-01T17:22:37.377Z

Link: CVE-2026-104037

cve-icon Vulnrichment

Updated: 2026-10-06T13:27:56.659Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T01:16:34.707

Modified: 2026-10-06T15:09:20.387

Link: CVE-2026-104037

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T23:50:12Z

Links: CVE-2026-104037 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:56:16Z

Weaknesses