Amazon Linux 2023 : libipa_hbac, libipa_hbac-devel, libsss_autofs (ALAS2023-2026-3416)

high Nessus Plugin ID 377933

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3416 advisory.

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS). (CVE-2026-104029)

A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS). (CVE-2026-104031)

A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption. (CVE-2026-104032)

A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account.
A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated. (CVE-2026-104033)

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS). (CVE-2026-104034)

A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive. (CVE-2026-104035)

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to oversized cached entries, resulting in an out-of-bounds write. This flaw primarily leads to a Denial of Service (DoS) by crashing the identity mapping service, and may also corrupt adjacent process memory. (CVE-2026-104036)

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).
(CVE-2026-104037)

A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations. (CVE-2026-104038)

A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate. (CVE-2026-104039)

A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash. (CVE-2026-104042)

A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS). (CVE-2026-104043)

A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.
(CVE-2026-104045)

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts. (CVE-2026-104048)

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. (CVE-2026-68742)

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. (CVE-2026-68743)

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process. (CVE-2026-68744)

A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.
(CVE-2026-80048)

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
(CVE-2026-88252)

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available. (CVE-2026-90462)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out- of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure. (CVE-2026-90463)

A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service. (CVE-2026-90994)

A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request.
If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services. (CVE-2026-90995)

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero- length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder. (CVE-2026-90996)

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems. (CVE-2026-92821)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update sssd --releasever 2023.12.20261109' or or 'dnf update --advisory ALAS2023-2026-3416 --releasever 2023.12.20261109' to update your system.

Plugin Details

Severity: High

ID: 377933

File Name: al2023_ALAS2023-2026-3416.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 11/9/2026

Updated: 11/9/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.54

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-104048

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:libipa_hbac-debuginfo, p-cpe:/a:amazon:linux:libipa_hbac-devel, p-cpe:/a:amazon:linux:libipa_hbac, p-cpe:/a:amazon:linux:libsss_autofs-debuginfo, p-cpe:/a:amazon:linux:libsss_autofs, p-cpe:/a:amazon:linux:libsss_certmap-debuginfo, p-cpe:/a:amazon:linux:libsss_certmap-devel, p-cpe:/a:amazon:linux:libsss_certmap, p-cpe:/a:amazon:linux:libsss_idmap-debuginfo, p-cpe:/a:amazon:linux:libsss_idmap-devel, p-cpe:/a:amazon:linux:libsss_idmap, p-cpe:/a:amazon:linux:libsss_nss_idmap-debuginfo, p-cpe:/a:amazon:linux:libsss_nss_idmap-devel, p-cpe:/a:amazon:linux:libsss_nss_idmap, p-cpe:/a:amazon:linux:libsss_simpleifp-debuginfo, p-cpe:/a:amazon:linux:libsss_simpleifp-devel, p-cpe:/a:amazon:linux:libsss_simpleifp, p-cpe:/a:amazon:linux:libsss_sudo-debuginfo, p-cpe:/a:amazon:linux:libsss_sudo, p-cpe:/a:amazon:linux:python3-libipa_hbac-debuginfo, p-cpe:/a:amazon:linux:python3-libipa_hbac, p-cpe:/a:amazon:linux:python3-libsss_nss_idmap-debuginfo, p-cpe:/a:amazon:linux:python3-libsss_nss_idmap, p-cpe:/a:amazon:linux:python3-sss-debuginfo, p-cpe:/a:amazon:linux:python3-sss-murmur-debuginfo, p-cpe:/a:amazon:linux:python3-sss-murmur, p-cpe:/a:amazon:linux:python3-sss, p-cpe:/a:amazon:linux:python3-sssdconfig, p-cpe:/a:amazon:linux:sssd-ad-debuginfo, p-cpe:/a:amazon:linux:sssd-ad, p-cpe:/a:amazon:linux:sssd-client-debuginfo, p-cpe:/a:amazon:linux:sssd-client, p-cpe:/a:amazon:linux:sssd-common-debuginfo, p-cpe:/a:amazon:linux:sssd-common-pac-debuginfo, p-cpe:/a:amazon:linux:sssd-common-pac, p-cpe:/a:amazon:linux:sssd-common, p-cpe:/a:amazon:linux:sssd-dbus-debuginfo, p-cpe:/a:amazon:linux:sssd-dbus, p-cpe:/a:amazon:linux:sssd-debuginfo, p-cpe:/a:amazon:linux:sssd-debugsource, p-cpe:/a:amazon:linux:sssd-idp-debuginfo, p-cpe:/a:amazon:linux:sssd-idp, p-cpe:/a:amazon:linux:sssd-ipa-debuginfo, p-cpe:/a:amazon:linux:sssd-ipa, p-cpe:/a:amazon:linux:sssd-kcm-debuginfo, p-cpe:/a:amazon:linux:sssd-kcm, p-cpe:/a:amazon:linux:sssd-krb5-common-debuginfo, p-cpe:/a:amazon:linux:sssd-krb5-common, p-cpe:/a:amazon:linux:sssd-krb5-debuginfo, p-cpe:/a:amazon:linux:sssd-krb5, p-cpe:/a:amazon:linux:sssd-ldap-debuginfo, p-cpe:/a:amazon:linux:sssd-ldap, p-cpe:/a:amazon:linux:sssd-nfs-idmap-debuginfo, p-cpe:/a:amazon:linux:sssd-nfs-idmap, p-cpe:/a:amazon:linux:sssd-proxy-debuginfo, p-cpe:/a:amazon:linux:sssd-proxy, p-cpe:/a:amazon:linux:sssd-tools-debuginfo, p-cpe:/a:amazon:linux:sssd-tools, p-cpe:/a:amazon:linux:sssd-winbind-idmap-debuginfo, p-cpe:/a:amazon:linux:sssd-winbind-idmap, p-cpe:/a:amazon:linux:sssd

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/9/2026

Vulnerability Publication Date: 8/3/2026

Reference Information

CVE: CVE-2026-104029, CVE-2026-104031, CVE-2026-104032, CVE-2026-104033, CVE-2026-104034, CVE-2026-104035, CVE-2026-104036, CVE-2026-104037, CVE-2026-104038, CVE-2026-104039, CVE-2026-104042, CVE-2026-104043, CVE-2026-104045, CVE-2026-104048, CVE-2026-68742, CVE-2026-68743, CVE-2026-68744, CVE-2026-80048, CVE-2026-88252, CVE-2026-90462, CVE-2026-90463, CVE-2026-90994, CVE-2026-90995, CVE-2026-90996, CVE-2026-92821

Detections

Analytics