CVE-2026-6245: SSSD PAM Passkey DoS Vulnerability

CVE-2026-6245 Overview

A flaw was found in the System Security Services Daemon (SSSD) affecting the PAM passkey responder functionality. The pam_passkey_child_read_data() function fails to properly handle raw bytes received from a pipe, treating the data as a NUL-terminated C string without explicit termination. This improper handling results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash and resulting in a local Denial of Service (DoS) condition.

Critical Impact

Local attackers can crash the SSSD PAM responder through crafted passkey authentication requests, disrupting authentication services on affected Linux systems.

Affected Products

• System Security Services Daemon (SSSD)
• Linux distributions using SSSD for authentication
• Systems with PAM passkey authentication enabled

Discovery Timeline

• 2026-04-15 - CVE CVE-2026-6245 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-6245

Vulnerability Analysis

This vulnerability is classified as CWE-805 (Buffer Access with Incorrect Length Value), which occurs when a buffer is accessed using a length value that exceeds the actual buffer size. In the context of SSSD, the pam_passkey_child_read_data() function reads raw bytes from a pipe without ensuring proper NUL termination before passing the data to string manipulation functions.

When the received data lacks explicit NUL termination, subsequent calls to snprintf() or similar functions continue reading beyond the intended buffer boundaries. This out-of-bounds read can access memory outside the allocated buffer, leading to undefined behavior and process crashes.

The vulnerability requires local access to the system, meaning an attacker must have the ability to authenticate or interact with the PAM subsystem. While this limits the attack surface, systems that provide multi-user access or shared computing environments are particularly at risk.

Root Cause

The root cause lies in the assumption that data received via the pipe is properly NUL-terminated. The pam_passkey_child_read_data() function does not explicitly append a NUL terminator after reading the raw bytes, nor does it validate the presence of one before treating the buffer as a C string. When this unterminated buffer is passed to snprintf(), the function reads beyond the allocated memory space searching for the string terminator.

Attack Vector

The attack leverages the local interface where a malicious actor with local system access initiates a specially crafted passkey authentication request. By controlling the data sent through the pipe communication channel to the PAM passkey responder, an attacker can supply data that lacks proper NUL termination.

The vulnerability can be triggered through the following sequence:

1. The attacker initiates a passkey authentication attempt through the PAM interface
2. Malformed data is sent through the internal pipe communication
3. The pam_passkey_child_read_data() function reads the raw bytes without adding termination
4. When processing functions like snprintf() attempt to read the buffer as a string, they read beyond the buffer boundaries
5. The out-of-bounds memory access triggers a crash in the SSSD PAM responder

For technical details regarding the vulnerability mechanism, refer to the Red Hat CVE-2026-6245 Advisory and Red Hat Bug Report #2457954.

Detection Methods for CVE-2026-6245

Indicators of Compromise

• Unexpected crashes or restarts of the sssd service, particularly the PAM responder component
• Core dumps or segmentation fault errors in system logs referencing SSSD PAM processes
• Repeated authentication failures or service disruptions correlating with passkey authentication attempts
• Abnormal memory access patterns in SSSD process monitoring

Detection Strategies

• Monitor system logs (/var/log/sssd/) for segmentation faults or crash reports related to PAM passkey operations
• Implement process monitoring to detect unexpected terminations of sssd_pam child processes
• Configure auditd rules to track authentication events and correlate with service crashes
• Deploy SentinelOne agents to detect anomalous process behavior and crash patterns indicative of exploitation attempts

Monitoring Recommendations

• Enable detailed SSSD debug logging to capture passkey authentication flow anomalies
• Set up alerting for sssd service restart events that may indicate crash recovery
• Monitor for elevated authentication failure rates that could signal ongoing DoS attempts
• Review core dump analysis for memory access violations in PAM-related functions

How to Mitigate CVE-2026-6245

Immediate Actions Required

• Review the Red Hat CVE-2026-6245 Advisory for vendor-specific patches and updates
• Monitor Red Hat Bug Report #2457954 for patch availability and update information
• Consider disabling passkey authentication if not required until patches are applied
• Restrict local access to trusted users to reduce the attack surface
• Ensure SSSD service is configured with automatic restart to minimize DoS impact

Patch Information

Organizations should monitor the official Red Hat security advisories and their Linux distribution's security update channels for patches addressing this vulnerability. Apply updates to SSSD packages as soon as they become available from your distribution's security repository.

Consult the Red Hat CVE-2026-6245 Advisory for the latest patch status and remediation guidance.

Workarounds

• Disable passkey authentication in SSSD configuration if the feature is not actively required
• Implement strict access controls to limit local user accounts that can interact with PAM
• Configure process monitoring and automatic service restart for SSSD to minimize denial of service duration
• Use alternative authentication methods while awaiting official patches

# Configuration example - Disable passkey auth in SSSD (if not needed)
# Edit /etc/sssd/sssd.conf and add or modify:
[pam]
pam_passkey_auth = false

# Restart SSSD service after configuration change
sudo systemctl restart sssd