Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:sssd User: [email protected] Usertags: pu
Security update of sssd in Debian trixie. [ Reason ] This upload fixes various vulnerabilities of sssd in Debian trixie: * CVE-2025-11561 * CVE-2026-6245 * CVE-2026-12610 * CVE-2026-14474 * CVE-2026-14476 * CVE-2026-68742 * CVE-2026-68743 * CVE-2026-68744 Undocumented in d/changelog (unfortunately), it adds a patch that make unit tests succeed on systems where ntp(sec) daemon is installed and running: * test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff Let me know if you prefer a re-upload of 2.10.1-2+deb13u1 that mentions the above named patch in d/changelog. [ Impact ] sssd in trixie stays vulnerable. [ Tests ] Unit tests. Smoke test on a Debian Edu roaming workstation. [ Risks ] For sssd users / on sites using sssd regressions may occur. [ Checklist ] [x] *(nearly) all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] ``` diff -Nru sssd-2.10.1/debian/changelog sssd-2.10.1/debian/changelog --- sssd-2.10.1/debian/changelog 2025-01-14 07:45:10.000000000 +0100 +++ sssd-2.10.1/debian/changelog 2026-09-08 05:21:12.000000000 +0200 @@ -1,3 +1,24 @@ +sssd (2.10.1-2+deb13u1) trixie; urgency=medium + + * debian/patches: + + Add CVE-2026-12610.diff. (Closes: #1141323). + CVE-2026-12610: PAM: fix use-after-free during p11_child processing. + + Add CVE-2025-11561.diff. (Closes: #1117935). + CVE-2025-11561: krb5: disable Kerberos localauth an2ln plugin for AD/IPA. + + Add CVE-2026-6245.diff. (Closes: #1134269). + CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data. + + Add CVE-2026-14474.diff and CVE-2026-14476.diff. (Closes: #1141769). + CVE-2026-14474: sudo: warn when ldap_sudo_search_base falls back to root DN. + CVE-2026-14476: gpo: reject path traversal in gPCFileSysPath. + * debian/patches: + + Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-2026-68744.diff + (Closes: #1143600, #1143947). + CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr(). + CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1(). + CVE-2026-68744: NSS: fix initgroups packet heap disclosure. + + -- Mike Gabriel <[email protected]> Tue, 08 Sep 2026 05:21:12 +0200 + sssd (2.10.1-2) unstable; urgency=medium [ Timo Aaltonen ] ``` [ Other info ] None.
diff -Nru sssd-2.10.1/debian/changelog sssd-2.10.1/debian/changelog --- sssd-2.10.1/debian/changelog 2025-01-14 07:45:10.000000000 +0100 +++ sssd-2.10.1/debian/changelog 2026-09-08 05:21:12.000000000 +0200 @@ -1,3 +1,24 @@ +sssd (2.10.1-2+deb13u1) trixie; urgency=medium + + * debian/patches: + + Add CVE-2026-12610.diff. (Closes: #1141323). + CVE-2026-12610: PAM: fix use-after-free during p11_child processing. + + Add CVE-2025-11561.diff. (Closes: #1117935). + CVE-2025-11561: krb5: disable Kerberos localauth an2ln plugin for AD/IPA. + + Add CVE-2026-6245.diff. (Closes: #1134269). + CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data. + + Add CVE-2026-14474.diff and CVE-2026-14476.diff. (Closes: #1141769). + CVE-2026-14474: sudo: warn when ldap_sudo_search_base falls back to root DN. + CVE-2026-14476: gpo: reject path traversal in gPCFileSysPath. + * debian/patches: + + Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-2026-68744.diff + (Closes: #1143600, #1143947). + CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr(). + CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1(). + CVE-2026-68744: NSS: fix initgroups packet heap disclosure. + + -- Mike Gabriel <[email protected]> Tue, 08 Sep 2026 05:21:12 +0200 + sssd (2.10.1-2) unstable; urgency=medium [ Timo Aaltonen ] diff -Nru sssd-2.10.1/debian/patches/CVE-2025-11561.diff sssd-2.10.1/debian/patches/CVE-2025-11561.diff --- sssd-2.10.1/debian/patches/CVE-2025-11561.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2025-11561.diff 2026-09-08 05:21:12.000000000 +0200 @@ -0,0 +1,46 @@ +From 9edd2b3bb9bcff132969fadd402b4891b2ddb9e3 Mon Sep 17 00:00:00 2001 +From: Sumit Bose <[email protected]> +Date: Fri, 10 Oct 2025 12:57:40 +0200 +Subject: [PATCH] krb5: disable Kerberos localauth an2ln plugin for AD/IPA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If a client is joined to AD or IPA SSSD's localauth plugin can handle +the mapping of Kerberos principals to local accounts. In case it cannot +map the Kerberos principals libkrb5 is currently configured to fall back +to the default localauth plugins 'default', 'rule', 'names', +'auth_to_local', 'k5login' and 'an2ln' (see man krb5.conf for details). +All plugins except 'an2ln' require some explicit configuration by either +the administrator or the local user. To avoid some unexpected mapping is +done by the 'an2ln' plugin this patch disables it in the configuration +snippets for SSSD's localauth plugin. + +Resolves: https://github.com/SSSD/sssd/issues/8021 + +:relnote: After startup SSSD already creates a Kerberos configuration + snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin + if the AD or IPA providers are used. This enables SSSD's localauth plugin. + Starting with this release the an2ln plugin is disabled in the + configuration snippet as well. If this file or its content are included in + the Kerberos configuration it will fix CVE-2025-11561. + +Reviewed-by: Alexey Tikhonov <[email protected]> +Reviewed-by: Pavel Březina <[email protected]> +(cherry picked from commit 9939c39d1949fad48af2f0b43c788bad0809e310) +--- + src/util/domain_info_utils.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c +index 79400e9015d..4a27e8123a4 100644 +--- a/src/util/domain_info_utils.c ++++ b/src/util/domain_info_utils.c +@@ -747,6 +747,7 @@ static errno_t sss_write_krb5_snippet_common(const char *file_name, + #define LOCALAUTH_PLUGIN_CONFIG \ + "[plugins]\n" \ + " localauth = {\n" \ ++" disable = an2ln\n" \ + " module = sssd:"APP_MODULES_PATH"/sssd_krb5_localauth_plugin.so\n" \ + " }\n" + diff -Nru sssd-2.10.1/debian/patches/CVE-2026-12610.diff sssd-2.10.1/debian/patches/CVE-2026-12610.diff --- sssd-2.10.1/debian/patches/CVE-2026-12610.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-12610.diff 2026-09-08 05:21:12.000000000 +0200 @@ -0,0 +1,102 @@ +From db7ffa3ea6a971bb84bc54558ca7217751724334 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <[email protected]> +Date: Mon, 29 Jun 2026 21:46:46 +0200 +Subject: [PATCH] PAM: fix use-after-free during p11_child processing + +`pam_check_cert_send()` stored `pctx->sss_certmap_ctx` in the +request state. If `p11_refresh_certmap_ctx()` ran while `p11_child` +was still executing (e.g. triggered by a domain refresh), it freed +and replaced the certmap context, leaving the request state holding +a dangling pointer. `p11_child_done()` could later use that pointer. + +Fix this by passing the `pam_ctx` into `pam_check_cert_send()` and +dereferencing `pctx->sss_certmap_ctx` at the time it is actually needed +in `p11_child_done()`, so the current context is always used. + +Resolves: https://github.com/SSSD/sssd/issues/8796 +Fixes: CVE-2026-12610 + +Assisted-By: Claude Code (Opus 4.6) +Reviewed-by: Iker Pedrosa <[email protected]> +Reviewed-by: Sumit Bose <[email protected]> +(cherry picked from commit fa7a55949a30fed064a28ea6f0c801fc5e8c5ba7) +--- + src/responder/pam/pamsrv.h | 2 +- + src/responder/pam/pamsrv_cmd.c | 2 +- + src/responder/pam/pamsrv_p11.c | 11 ++++++----- + 3 files changed, 8 insertions(+), 7 deletions(-) + +--- a/src/responder/pam/pamsrv.h ++++ b/src/responder/pam/pamsrv.h +@@ -146,7 +146,7 @@ + const char *ca_db, + time_t timeout, + const char *verify_opts, +- struct sss_certmap_ctx *sss_certmap_ctx, ++ struct pam_ctx *pctx, + const char *uri, + struct pam_data *pd); + errno_t pam_check_cert_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, +--- a/src/responder/pam/pamsrv_cmd.c ++++ b/src/responder/pam/pamsrv_cmd.c +@@ -1890,7 +1890,7 @@ + + req = pam_check_cert_send(mctx, ev, + pctx->ca_db, p11_child_timeout, +- cert_verification_opts, pctx->sss_certmap_ctx, ++ cert_verification_opts, pctx, + uri, pd); + if (req == NULL) { + DEBUG(SSSDBG_OP_FAILURE, "pam_check_cert_send failed.\n"); +--- a/src/responder/pam/pamsrv_p11.c ++++ b/src/responder/pam/pamsrv_p11.c +@@ -715,7 +715,7 @@ + struct sss_child_ctx_old *child_ctx; + struct tevent_timer *timeout_handler; + struct tevent_context *ev; +- struct sss_certmap_ctx *sss_certmap_ctx; ++ struct pam_ctx *pctx; + + struct child_io_fds *io; + +@@ -734,7 +734,7 @@ + const char *ca_db, + time_t timeout, + const char *verify_opts, +- struct sss_certmap_ctx *sss_certmap_ctx, ++ struct pam_ctx *pctx, + const char *uri, + struct pam_data *pd) + { +@@ -767,11 +767,12 @@ + goto done; + } + +- if (sss_certmap_ctx == NULL) { ++ if (pctx == NULL || pctx->sss_certmap_ctx == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, "Missing certificate matching context.\n"); + ret = EINVAL; + goto done; + } ++ state->pctx = pctx; + + state->pam_data = pd; + +@@ -851,7 +852,6 @@ + } + + state->ev = ev; +- state->sss_certmap_ctx = sss_certmap_ctx; + state->child_status = EFAULT; + state->io = talloc(state, struct child_io_fds); + if (state->io == NULL) { +@@ -1012,7 +1012,8 @@ + + PIPE_FD_CLOSE(state->io->read_from_child_fd); + +- ret = parse_p11_child_response(state, buf, buf_len, state->sss_certmap_ctx, ++ ret = parse_p11_child_response(state, buf, buf_len, ++ state->pctx->sss_certmap_ctx, + &state->cert_list); + if (ret != EOK) { + if (ret == ERR_P11_PIN_LOCKED) { diff -Nru sssd-2.10.1/debian/patches/CVE-2026-14474.diff sssd-2.10.1/debian/patches/CVE-2026-14474.diff --- sssd-2.10.1/debian/patches/CVE-2026-14474.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-14474.diff 2026-09-08 05:21:12.000000000 +0200 @@ -0,0 +1,74 @@ +From c29afbf02acf9e235eb5283f0325ea0037c1574a Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <[email protected]> +Date: Fri, 3 Jul 2026 13:25:08 +0200 +Subject: [PATCH] sudo: warn when ldap_sudo_search_base falls back to root DN +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When ldap_sudo_search_base is not explicitly configured, SSSD falls back +to the domain's naming context (root DN) and searches the entire LDAP +directory tree for sudoRole objects. Any LDAP principal with write access +to any subtree can inject a sudoRole granting arbitrary sudo privileges +on every enrolled host. + +This patch adds a warning log when the fallback occurs, alerting +administrators that their configuration searches the entire directory +tree for sudo rules. A future hardening step would be to default to +ou=sudoers,<base_dn> instead of the root DN. + +The warning approach preserves backwards compatibility while ensuring +administrators are aware of the security implications. + +Based on the patch by: Ian Murphy <[email protected]> +Amended by: Alexey Tikhonov <[email protected]> + +:fixes: CVE-2026-14474 + +Reviewed-by: Sumit Bose <[email protected]> +Reviewed-by: Tomáš Halman <[email protected]> +(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d) +--- + src/providers/ldap/sdap.c | 19 +++++++++++++++++++ + src/tests/system/tests/test_ldap.py | 2 +- + 2 files changed, 20 insertions(+), 1 deletion(-) + +--- a/src/providers/ldap/sdap.c ++++ b/src/providers/ldap/sdap.c +@@ -1341,6 +1341,25 @@ + + /* Sudo */ + if (!sdom->sudo_search_bases) { ++ /* At some point make this option mandatory, ++ * i.e. disable sudo rules lookup if 'sudo_search_bases' not set. ++ */ ++ DEBUG(SSSDBG_IMPORTANT_INFO, ++ "`ldap_sudo_search_base` is not set. SSSD will search the entire " ++ "directory tree (%s) for sudoRole objects. This may allow any " ++ "LDAP principal with write access to any subtree to inject " ++ "sudo rules granting arbitrary privileges. Set " ++ "`ldap_sudo_search_base` to restrict the search scope " ++ "(e.g., 'ou=sudoers,dc=example,dc=com').\n", ++ sdom->naming_context); ++ sss_log(SSS_LOG_ALERT, ++ "`ldap_sudo_search_base` is not set. SSSD will search the entire " ++ "directory tree (%s) for sudoRole objects. This may allow any " ++ "LDAP principal with write access to any subtree to inject " ++ "sudo rules granting arbitrary privileges. Set " ++ "`ldap_sudo_search_base` to restrict the search scope " ++ "(e.g., 'ou=sudoers,dc=example,dc=com').", ++ sdom->naming_context); + ret = sdap_set_search_base(opts, sdom, + SDAP_SUDO_SEARCH_BASE, + sdom->naming_context); +--- a/src/tests/tests/system/tests/test_ldap.py ++++ b/src/tests/tests/system/tests/test_ldap.py +@@ -245,7 +245,7 @@ + client.sssd.dom("test")["ldap_search_base"] = ldap.ldap.naming_context + + client.sssd.stop() +- client.sssd.clear() ++ client.sssd.clear(logs=True) + client.sssd.start() + + assert client.auth.ssh.password("puser1", "Secret123"), "User 'puser1' login failed!" diff -Nru sssd-2.10.1/debian/patches/CVE-2026-14476.diff sssd-2.10.1/debian/patches/CVE-2026-14476.diff --- sssd-2.10.1/debian/patches/CVE-2026-14476.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-14476.diff 2026-09-08 05:20:27.000000000 +0200 @@ -0,0 +1,172 @@ +From ba207eab76ff5253662a763b9b6e9ea42f03d31b Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <[email protected]> +Date: Thu, 2 Jul 2026 17:29:51 +0200 +Subject: [PATCH] gpo: reject path traversal in gPCFileSysPath +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed +by ad_gpo_extract_smb_components() which converts backslashes to forward +slashes but does not reject ".." path traversal sequences. The resulting +smb_path is used directly in gpo_cache_store_file() to construct a local +filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO +write access to write files outside the cache directory. + +Due to differential path resolution between libsmbclient (which clamps +".." at the SMB share root) and the kernel (which resolves ".." fully), +the SMB download succeeds while the local file write escapes the cache. +On systems with SELinux enforcing, this enables Kerberos configuration +injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t, +writable by sssd_t). On systems without SELinux, this enables arbitrary +file writes including cron job injection for root code execution. + +This patch adds two layers of defense: + +1. Reject ".." as a path component in smb_path at parse time in + ad_gpo_extract_smb_components(). Uses component-aware validation + that checks for "/..", "../", and exact ".." — not substring matching + which would false-positive on legitimate names containing "..". + +2. Validate the resolved cache path stays within GPO_CACHE_PATH in + gpo_cache_store_file() using realpath(), with a trailing-slash + prefix check to prevent prefix-collision attacks (e.g., + /var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache). + +Based on the patch by: Ian Murphy <[email protected]> +Amended by: Alexey Tikhonov <[email protected]> + +:fixes: CVE-2026-14476 + +Reviewed-by: Sumit Bose <[email protected]> +Reviewed-by: Tomáš Halman <[email protected]> +--- + src/providers/ad/ad_gpo.c | 47 +++++++++++++++++++++++++++++++ + src/providers/ad/ad_gpo_child.c | 49 +++++++++++++++++++++++++++++++++ + 2 files changed, 96 insertions(+) + +diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c +index 5c2f117a51c..b8562edc542 100644 +--- a/src/providers/ad/ad_gpo.c ++++ b/src/providers/ad/ad_gpo.c +@@ -3832,6 +3832,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx, + return ret; + } + ++/* ++ * Check whether a path contains ".." as a path component. ++ * Returns true if traversal is detected, false if the path is safe. ++ * ++ * Checks for: ++ * - "/.." anywhere in the path (component starting with ..) ++ * - "../" at the start of the path ++ * - exact match ".." (path is just "..") ++ * - "/.." at the end of the path ++ * ++ * Does NOT match ".." as a substring of a longer component ++ * (e.g., "my..file" is allowed). ++ */ ++static bool gpo_path_has_traversal(const char *path) ++{ ++ const char *p; ++ ++ if (path == NULL) { ++ return false; ++ } ++ ++ /* Exact match */ ++ if (strcmp(path, "..") == 0) return true; ++ ++ /* Starts with ../ */ ++ if (strncmp(path, "../", 3) == 0) return true; ++ ++ /* Contains /../ or ends with /.. */ ++ p = path; ++ while ((p = strstr(p, "/..")) != NULL) { ++ if (p[3] == '/' || p[3] == '\0') return true; ++ p += 3; ++ } ++ ++ return false; ++} ++ + /* + * This function parses the input_path into its components, replaces each + * back slash ('\') with a forward slash ('/'), and populates the output params. +@@ -3908,6 +3945,16 @@ ad_gpo_extract_smb_components(TALLOC_CTX *mem_ctx, + goto done; + } + ++ /* Reject path traversal. See function comment for what is matched. */ ++ if (gpo_path_has_traversal(smb_path)) { ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "gPCFileSysPath contains path traversal component '..': " ++ "[%s]. Rejecting to prevent cache directory escape.\n", ++ smb_path); ++ ret = EINVAL; ++ goto done; ++ } ++ + *_smb_server = talloc_asprintf(mem_ctx, "%s%s", + SMB_STANDARD_URI, + server_hostname); +diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c +index b8b47b09e49..db3716fdf02 100644 +--- a/src/providers/ad/ad_gpo_child.c ++++ b/src/providers/ad/ad_gpo_child.c +@@ -322,6 +322,55 @@ static errno_t gpo_cache_store_file(const char *smb_path, + goto done; + } + ++ /* Defense-in-depth: verify the resolved path stays within the cache ++ * directory (when updating existing files). This catches any bypass ++ * of the ".." check in the parser, including encoding tricks, symlink ++ * attacks, or future regressions. ++ * ++ * The trailing-slash comparison prevents prefix-collision attacks: ++ * without it, a path resolving to "/var/lib/sss/gpo_cache_evil/" ++ * would incorrectly match the prefix "/var/lib/sss/gpo_cache". ++ */ ++ { ++ char *resolved = realpath(filename, NULL); ++ if (resolved != NULL) { ++ /* Resolve GPO_CACHE_PATH too so the comparison works ++ * even when the cache path contains symlinks. */ ++ char *resolved_cache = realpath(GPO_CACHE_PATH, NULL); ++ if (resolved_cache == NULL) { ++ ret = errno; ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "realpath(\"%s\") failed: [%d][%s]\n", ++ GPO_CACHE_PATH, ret, strerror(ret)); ++ free(resolved); ++ goto done; ++ } ++ ++ /* Check that resolved path starts with resolved cache + "/" */ ++ size_t cache_len = strlen(resolved_cache); ++ bool inside = ((strlen(resolved) >= cache_len) && ++ (strncmp(resolved, resolved_cache, cache_len) == 0) && ++ (resolved[cache_len] == '/' || resolved[cache_len] == '\0')); ++ if (!inside) { ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "GPO cache path escapes cache directory: [%s] " ++ "resolves to [%s] which is outside [%s]. " ++ "Rejecting.\n", ++ filename, resolved, resolved_cache); ++ free(resolved_cache); ++ free(resolved); ++ ret = EINVAL; ++ goto done; ++ } ++ free(resolved_cache); ++ free(resolved); ++ } ++ /* If realpath returns NULL, the path doesn't exist yet. ++ * prepare_gpo_cache() will create it — the mkdir calls ++ * are validated by SELinux MAC policy. ++ */ ++ } ++ + tmp_name = talloc_asprintf(tmp_ctx, "%sXXXXXX", filename); + if (tmp_name == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n"); diff -Nru sssd-2.10.1/debian/patches/CVE-2026-6245.diff sssd-2.10.1/debian/patches/CVE-2026-6245.diff --- sssd-2.10.1/debian/patches/CVE-2026-6245.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-6245.diff 2026-09-08 05:21:12.000000000 +0200 @@ -0,0 +1,59 @@ +From 550b08cabe4dd5508c7ea74f634869374204d63f Mon Sep 17 00:00:00 2001 +From: Xu Raoqing <[email protected]> +Date: Tue, 21 Apr 2026 16:49:05 +0800 +Subject: [PATCH] pam: fix out-of-bounds read in pam_passkey_child_read_data + +The pam_passkey_child_read_data() function failed to properly handle +raw bytes received from a pipe. The data was treated as a NUL-terminated +C string without explicit termination, resulting in an out-of-bounds read +when processed by snprintf() with %s format. + +Fix by using memcpy instead of snprintf and explicitly NUL-terminating +the buffer. Add checks for buf_len == 0 or buf == NULL to avoid undefined +behavior. Check the return value of sss_authtok_set_passkey_reply and +propagate errors properly. + +Fixes: CVE-2026-6245 + +:relnote: Security fix for CVE-2026-6245: out-of-bounds read in PAM passkey responder + +Reviewed-by: Alexey Tikhonov <[email protected]> +Reviewed-by: Iker Pedrosa <[email protected]> +Reviewed-by: Sumit Bose <[email protected]> +--- + src/responder/pam/pamsrv_passkey.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/src/responder/pam/pamsrv_passkey.c ++++ b/src/responder/pam/pamsrv_passkey.c +@@ -837,16 +837,26 @@ + return; + } + +- str = malloc(sizeof(char) * buf_len); +- if (str == NULL) { ++ if (buf_len == 0 || buf == NULL) { ++ tevent_req_error(req, EINVAL); + return; + } + +- snprintf(str, buf_len, "%s", buf); ++ str = malloc(buf_len + 1); ++ if (str == NULL) { ++ tevent_req_error(req, ENOMEM); ++ return; ++ } + +- sss_authtok_set_passkey_reply(state->pd->authtok, str, 0); ++ memcpy(str, buf, buf_len); ++ str[buf_len] = '\0'; + ++ ret = sss_authtok_set_passkey_reply(state->pd->authtok, str, 0); + free(str); ++ if (ret != EOK) { ++ tevent_req_error(req, ret); ++ return; ++ } + + tevent_req_done(req); + return; diff -Nru sssd-2.10.1/debian/patches/CVE-2026-68742.diff sssd-2.10.1/debian/patches/CVE-2026-68742.diff --- sssd-2.10.1/debian/patches/CVE-2026-68742.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-68742.diff 2026-09-08 05:09:12.000000000 +0200 @@ -0,0 +1,53 @@ +From cb806786db2c7c7fc3b000fe824f761a7d8481e0 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <[email protected]> +Date: Tue, 4 Aug 2026 20:08:28 +0200 +Subject: [PATCH] nss: validate addrlen in sss_nss_protocol_parse_addr() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +:fixes: CVE-2026-68742 + +Reviewed-by: Pavel Březina <[email protected]> +Reviewed-by: Sumit Bose <[email protected]> +(cherry picked from commit 2839e8ccffebbb6bd605047b012eaa5fdb56b9d3) +--- + src/responder/nss/nss_protocol.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/src/responder/nss/nss_protocol.c b/src/responder/nss/nss_protocol.c +index e6dc7023bca..aa9eca37187 100644 +--- a/src/responder/nss/nss_protocol.c ++++ b/src/responder/nss/nss_protocol.c +@@ -23,6 +23,8 @@ + #include "lib/idmap/sss_idmap.h" + #include "responder/nss/nss_protocol.h" + #include <arpa/inet.h> ++#include <sys/socket.h> ++#include <arpa/nameser.h> + + errno_t + sss_nss_protocol_done(struct cli_ctx *cli_ctx, errno_t error) +@@ -467,6 +469,22 @@ sss_nss_protocol_parse_addr(struct cli_ctx *cli_ctx, + SAFEALIGN_COPY_UINT32(&af, body, NULL); + SAFEALIGN_COPY_UINT32(&addrlen, body + sizeof(uint32_t), NULL); + ++ if (addrlen != blen - sizeof(uint32_t) * 2) { ++ return EINVAL; ++ } ++ ++ if (af == AF_INET) { ++ if (addrlen != INADDRSZ) { ++ return EINVAL; ++ } ++ } else if (af == AF_INET6) { ++ if (addrlen != IN6ADDRSZ) { ++ return EINVAL; ++ } ++ } else { ++ return EINVAL; ++ } ++ + addr = body + sizeof(uint32_t) * 2; + + /* If the body isn't a addr, fail */ diff -Nru sssd-2.10.1/debian/patches/CVE-2026-68743.diff sssd-2.10.1/debian/patches/CVE-2026-68743.diff --- sssd-2.10.1/debian/patches/CVE-2026-68743.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-68743.diff 2026-09-08 05:20:27.000000000 +0200 @@ -0,0 +1,34 @@ +From 1ea0f2da77947598165da2b84202d355f43c9aa1 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <[email protected]> +Date: Tue, 4 Aug 2026 20:51:07 +0200 +Subject: [PATCH] pam: validate auth_token_length in extract_authtok_v1() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The check mimics one existing in `extract_authtok_v2()` + +:fixes: CVE-2026-68743 + +Assisted-By: Claude Code (Opus 4.6) +Reviewed-by: Pavel Březina <[email protected]> +Reviewed-by: Sumit Bose <[email protected]> +(cherry picked from commit bef9d12617f22335e65447609a2724a68c1bf68a) +--- + src/responder/pam/pamsrv_cmd.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/src/responder/pam/pamsrv_cmd.c ++++ b/src/responder/pam/pamsrv_cmd.c +@@ -450,6 +450,11 @@ + + SAFEALIGN_COPY_UINT32_CHECK(&auth_token_type, &body[*c], blen, c); + SAFEALIGN_COPY_UINT32_CHECK(&auth_token_length, &body[*c], blen, c); ++ ++ if (*c + auth_token_length > blen || SIZE_T_OVERFLOW(*c, auth_token_length)) { ++ return EINVAL; ++ } ++ + auth_token_data = body+(*c); + + switch (auth_token_type) { diff -Nru sssd-2.10.1/debian/patches/CVE-2026-68744.diff sssd-2.10.1/debian/patches/CVE-2026-68744.diff --- sssd-2.10.1/debian/patches/CVE-2026-68744.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/CVE-2026-68744.diff 2026-09-08 05:20:27.000000000 +0200 @@ -0,0 +1,52 @@ +From 815d761330265484b2b8788742a3a81ace6d0484 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <[email protected]> +Date: Mon, 3 Aug 2026 17:28:54 +0200 +Subject: [PATCH] NSS: fix initgroups packet heap disclosure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +sss_nss_protocol_fill_initgr() pre-allocates the reply packet for all +group entries in result->count, but groups may be skipped when they are +non-POSIX, incomplete, or filtered by the negative cache. +Shrink the packet after filling it so it contains exactly the data that +was written. + +:fixes: CVE-2026-68744 + +Assisted-By: Claude Code (Opus 4.6) +Reviewed-by: Pavel Březina <[email protected]> +Reviewed-by: Sumit Bose <[email protected]> +(cherry picked from commit f5be5002a2e43ff9d2a22a95ffe4e0eeb56e0d3d) +--- + src/responder/nss/nss_protocol_grent.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/responder/nss/nss_protocol_grent.c b/src/responder/nss/nss_protocol_grent.c +index c2a0b93f80f..ed94b6665af 100644 +--- a/src/responder/nss/nss_protocol_grent.c ++++ b/src/responder/nss/nss_protocol_grent.c +@@ -442,10 +442,7 @@ sss_nss_protocol_fill_initgr(struct sss_nss_ctx *nss_ctx, + } + } + +- if (orig_gid == 0) { +- /* Initialize allocated memory to be safe and make Valgrind happy. */ +- SAFEALIGN_SET_UINT32(&body[rp], 0, &rp); +- } else { ++ if (orig_gid != 0) { + /* Insert original primary group into the result. */ + SAFEALIGN_COPY_UINT32(&body[rp], &orig_gid, &rp); + num_results++; +@@ -473,5 +470,11 @@ sss_nss_protocol_fill_initgr(struct sss_nss_ctx *nss_ctx, + SAFEALIGN_COPY_UINT32(body, &num_results, NULL); + SAFEALIGN_SETMEM_UINT32(body + sizeof(uint32_t), 0, NULL); /* reserved */ + ++ /* Shrink packet to actual data size to avoid sending uninitialized heap. */ ++ ret = sss_packet_set_size(packet, (2 + num_results) * sizeof(uint32_t)); ++ if (ret != EOK) { ++ return ret; ++ } ++ + return EOK; + } diff -Nru sssd-2.10.1/debian/patches/series sssd-2.10.1/debian/patches/series --- sssd-2.10.1/debian/patches/series 2025-01-14 07:31:55.000000000 +0100 +++ sssd-2.10.1/debian/patches/series 2026-09-08 05:21:12.000000000 +0200 @@ -1,3 +1,12 @@ fix-whitespace-test.diff default-to-socket-activated-services.diff drop-valgrind.diff +CVE-2025-11561.diff +CVE-2026-6245.diff +CVE-2026-12610.diff +CVE-2026-14474.diff +CVE-2026-14476.diff +CVE-2026-68742.diff +CVE-2026-68743.diff +CVE-2026-68744.diff +test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff diff -Nru sssd-2.10.1/debian/patches/test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff sssd-2.10.1/debian/patches/test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff --- sssd-2.10.1/debian/patches/test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff 1970-01-01 01:00:00.000000000 +0100 +++ sssd-2.10.1/debian/patches/test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff 2026-09-08 05:21:12.000000000 +0200 @@ -0,0 +1,34 @@ +From e4eb8bdc006e800fe2f875de9f447bc8a8478bb1 Mon Sep 17 00:00:00 2001 +From: Gleb Popov <[email protected]> +Date: Fri, 16 Jan 2026 16:45:19 +0300 +Subject: [PATCH] test_pam_srv: Use more random UIDs/GIDs for the test + +On FreeBSD the UID 123 corresponds to the built-in ntpd user and the machine +that runs this test may be running the ntpd daemon. + +Reviewed-by: Alexey Tikhonov <[email protected]> +Reviewed-by: Sumit Bose <[email protected]> +--- + src/tests/cmocka/test_pam_srv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/src/tests/cmocka/test_pam_srv.c ++++ b/src/tests/cmocka/test_pam_srv.c +@@ -312,7 +312,7 @@ + /* Prime the cache with a valid user */ + ret = sysdb_add_user(pam_test_ctx->tctx->dom, + pam_test_ctx->pam_user_fqdn, +- 123, 456, "pam user", ++ 12345, 67890, "pam user", + "/home/pamuser", "/bin/sh", NULL, + NULL, 300, now); + assert_int_equal(ret, EOK); +@@ -331,7 +331,7 @@ + /* Prime the cache with a user for wrong matches */ + ret = sysdb_add_user(pam_test_ctx->tctx->dom, + pam_test_ctx->wrong_user_fqdn, +- 321, 654, "wrong user", ++ 32109, 65432, "wrong user", + "/home/wronguser", "/bin/sh", NULL, + NULL, 300, now); + assert_int_equal(ret, EOK);
