Cloudanix VulnDB

CVE-2026-104037

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A person already logged into the computer can send specially made data that crashes an important background service, briefly stopping users from logging in or accessing resources.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits a local attacker to send a crafted request containing an invalid packet length to the autofs responder UNIX domain socket, triggering an integer underflow that leads to an out-of-bounds memory read and subsequent crash of the responder process.

Why it matters to the business

Causes local denial of service against identity and authentication services, leading to temporary unavailability of login and access controls for users and applications on affected systems.

How an attack unfolds

A local attacker identifies the autofs responder UNIX socket, constructs a request with an invalid packet length field, and transmits it to induce integer underflow and out-of-bounds read, crashing the process and achieving denial of service.

How to fix it

Upgrade SSSD to a version containing length validation fixes for the autofs responder; restrict UNIX socket permissions to root or dedicated service accounts only; consider disabling the autofs responder if unused.

How to confirm the fix worked

Confirm updated SSSD packages are installed, review process stability after applying changes, and test socket interactions in an isolated environment to ensure no crash occurs on invalid lengths.

Typical attack path

  1. Obtain local user access on the target system
  2. Locate the autofs responder UNIX domain socket path
  3. Craft a request packet with an invalid length value
  4. Send the malformed request to trigger underflow and crash

How to detect it

Inspect system and daemon logs for abrupt termination messages or segmentation faults involving the autofs responder; correlate socket activity with process crashes; review audit logs for unusual local connections to the socket.

What your security team should do

  • Prioritize patching SSSD across all Linux deployments once fixes are released
  • Enforce strict file permissions and ownership on responder sockets
  • Enable monitoring for unexpected termination of sssd responder processes
  • Review and minimize exposure of local UNIX sockets to unprivileged users

The record

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities