Cloudanix VulnDB

CVE-2026-104043

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A local user on a Linux machine can send a specially made request that crashes the service handling user and group lookups, briefly stopping logins and name lookups.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local attacker with access to the NSS responder UNIX socket triggers integer underflow via undersized packet header, causing out-of-bounds memory read during parsing and crashing the responder process.

Why it matters to the business

Disrupts name service and authentication operations on affected Linux systems, leading to temporary loss of user login, group resolution, and related services until the responder is restarted.

How an attack unfolds

An attacker with local access crafts a request packet with an undersized header and sends it to the SSSD NSS responder UNIX socket, triggering the underflow and out-of-bounds read that crashes the process.

How to fix it

Upgrade SSSD to a version containing the fix for the integer underflow in the NSS responder packet parser as soon as patches are released by the distribution or upstream project.

How to confirm the fix worked

Confirm the installed SSSD package version includes the patch; attempt to reproduce the crash with a minimal crafted packet against the NSS socket in a test environment and verify the responder remains stable.

Typical attack path

  1. Obtain local access on a system running SSSD
  2. Locate the NSS responder UNIX socket
  3. Craft a request packet containing an undersized header
  4. Send the packet to the socket to trigger the integer underflow
  5. Observe the resulting out-of-bounds read and process crash

How to detect it

Review system and SSSD logs for sudden responder process crashes or segmentation faults around the time of authentication or name service activity; look for repeated restarts of the NSS responder.

  • sssd_nss process crash
  • segmentation fault in sssd responder
  • NSS socket packet parsing error

What your security team should do

  • Monitor upstream and distribution advisories for SSSD patches and apply them promptly
  • Restrict local access to the NSS responder UNIX socket using filesystem permissions where possible
  • Implement process monitoring and automatic restart for the SSSD responder to reduce DoS duration

The record

A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities