Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1267580 (CVE-2015-5292)

Summary:	CVE-2015-5292 sssd: memory leak in the sssd_pac_plugin
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bkearney, carnil, cpelland, dajohnso, dclarizi, gblomqui, gmccullo, grajaiya, gtanzill, jfrey, jgalipea, jhardy, jhrozek, jprause, kseifried, lslebodn, mkosek, mmccune, mprpic, mzidek, obarenbo, ohadlevy, pbrezina, roliveri, security-response-team, sgoveas, tjay, tlestach, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-10 15:01:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1266404, 1267176, 1268783, 1268807
Bug Blocks:

Description Martin Prpič 2015-09-30 13:11:09 UTC

A memory leak was found in the sssd_pac_plugin (sssd_pac_plugin.so library), which is distributed with the sssd_client package.

Original report with additional details:

https://fedorahosted.org/sssd/ticket/2803

Patch:

https://fedorahosted.org/sssd/attachment/ticket/2803/0001-Fix-memory-leak-in-sssdpac_verify.patch

Comment 5 Martin Prpič 2015-10-05 10:38:04 UTC

Created sssd tracking bugs for this issue:

Affects: fedora-all [bug 1268807]

Comment 6 Fedora Update System 2015-10-11 16:03:45 UTC

sssd-1.13.1-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2015-10-20 01:54:39 UTC

sssd-1.13.1-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2015-10-20 02:53:42 UTC

sssd-1.12.5-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 Martin Prpič 2015-10-20 13:05:21 UTC

Analysis:

The issue is in the PAC responder that's provided with SSSD. When an application is configured to use Kerberos and authenticate against SSSD's PAC responder, the responder leaks a small amount of memory on every authentication attempt. This could allow an attacker to eventually exhaust all available memory on the system by sending numerous auth requests to a running application (daemon) configured as stated above.

The vulnerable code is detailed in https://fedorahosted.org/sssd/ticket/2803

Comment 16 errata-xmlrpc 2015-11-10 13:01:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:2019 https://rhn.redhat.com/errata/RHSA-2015-2019.html

Comment 17 errata-xmlrpc 2015-11-19 11:40:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2355 https://rhn.redhat.com/errata/RHSA-2015-2355.html