[From nobody Fri Sep  4 22:19:05 2026
Received: (at submit) by bugs.debian.org; 18 Apr 2026 15:03:25 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-18.1 required=4.0 tests=BAYES_00,
 BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,
 DKIM_VALID_EF,FOURLA,HAS_PACKAGE,SPF_HELO_NONE,SPF_PASS,X_DEBBUGS_CC
 autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 19; hammy, 150; neutral, 67; spammy,
 0. spammytokens: hammytokens:0.000-+--HX-Debbugs-Cc:sk:debian-,
 0.000-+--U*debian-security, 0.000-+--debiansecuritylistsdebianorg,
 0.000-+--debian-security@lists.debian.org, 0.000-+--bugzilla.redhat.com
Return-path: <james_montgomery@disroot.org>
Received: from layka.disroot.org ([178.21.23.139]:33906)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <james_montgomery@disroot.org>)
 id 1wE7Cc-00GzNB-1w for submit@bugs.debian.org;
 Sat, 18 Apr 2026 15:03:25 +0000
Received: from [127.0.0.1] (localhost [127.0.0.1])
 by disroot.org (Postfix) with ESMTP id B203526561
 for <submit@bugs.debian.org>; Sat, 18 Apr 2026 17:03:18 +0200 (CEST)
X-Virus-Scanned: SPAM Filter at disroot.org
Received: from layka.disroot.org ([127.0.0.1])
 by localhost (disroot.org [127.0.0.1]) (amavis, port 10024) with ESMTP
 id zehjTAP_-NzA for <submit@bugs.debian.org>;
 Sat, 18 Apr 2026 17:03:17 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail;
 t=1776524597; bh=fZ3XDp6yzHKhwBS44DsjBODOzFcZ3RWPTngH7ICp9+U=;
 h=Date:From:To:Subject;
 b=H/o4WgmhaIiy6tXVhm+qlRH428ZDSFL5/7Sg2UD8l1dmCgvZnJ68YmLaBIp1LyJtY
 ihTmYz7V62VA8wiD98j+UuaBvOtqffzmGNPLzv2zrQQZweg1kfutcYVJv4h8rjayVx
 XsVRJbKqatGD720Rhf5vSoos1eId3qeRE2fJ9gPBf4UBXhVxFvWF3ICcPj+ae+riZN
 QSIRxALFC4JJECgH7YLh0Pd5oX5a4P0ZRk6di7W5xQ4sM0O4P1XM32AHAAjw3vDgjD
 ST04NFL3/beXJK4Se63ieWtt4sWRqtpwrvFB5dlagZgOtrUIbMgI9qfS9O5g9cgV1j
 7VlYP5aWzVhHA==
Date: Sat, 18 Apr 2026 15:03:15 +0000
Message-ID: <ba9408aa330c54d496d0743a2e6f5388@disroot.org>
From: James Montgomery <james_montgomery@disroot.org>
To: submit@bugs.debian.org
Subject: src:sssd: CVE-2026-6245: local DoS in PAM passkey responder
X-Debbugs-Cc: debian-security-tracker@lists.debian.org
Delivered-To: submit@bugs.debian.org

Package: src:sssd
Version: 2.12.0-4
Severity: important
Tags: security
User: debian-security@lists.debian.org
Usertags: CVE-2026-6245

Dear Maintainer,

The following vulnerability was published for sssd.

CVE-2026-6245[1]:
| A flaw was found in the System Security Services Daemon (SSSD). The
| pam_passkey_child_read_data() function within the PAM passkey responder
| fails to properly handle raw bytes received from a pipe. Because the data
| is treated as a NUL-terminated C string without explicit termination, it
| results in an out-of-bounds read when processed by functions like
| snprintf(). A local attacker could potentially trigger this vulnerability
| by initiating a crafted passkey authentication request, causing the SSSD
| PAM responder to crash, resulting in a local Denial of Service (DoS).

Red Hat rates this as Moderate with CVSS 5.5
(CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and currently lists the
affected packages as "Fix deferred"[2].

I checked the current Debian unstable source package, 2.12.0-4, and the
PAM passkey responder still appears to contain the affected pattern in
src/responder/pam/pamsrv_passkey.c:

    str = malloc(sizeof(char) * buf_len);
    ...
    snprintf(str, buf_len, "%s", buf);

Upstream master appears to contain the same code at the time of filing,
and I was not able to find a public upstream issue, pull request, or fixing
commit for this CVE yet.

[1] https://www.cve.org/CVERecord?id=CVE-2026-6245
[2] https://access.redhat.com/security/cve/CVE-2026-6245
[3] https://bugzilla.redhat.com/show_bug.cgi?id=2457954

Regards,
James
]