Technical impact
A local attacker can trigger a Denial of Service by sending a specially crafted Pluggable Authentication Module request when passkey authentication is enabled in the sssd service. The vulnerability arises from a missing state validation check in passkey Kerberos handling; the PAM responder dereferences an uninitialized pointer and crashes. This failure disrupts authentication services on the affected host, causing authentication requests to fail and potentially leaving the system in a degraded state.
Affected Systems
The vulnerability impacts several Red Hat products, including Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. Systems running these distributions with sssd enabled for passkey authentication are vulnerable.
Risk and Exploitability
The CVSS score of 6.2 indicates a moderate severity DoS risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. It is inferred that the attack requires local access to the host to craft the malicious PAM request, so the primary threat vector is local. While no public exploit is documented, the possibility of local attackers or compromised accounts to disrupt authentication services remains high.
