[Pkg-sssd-devel] [Git][sssd-team/sssd][master] 2 commits: debian/patches: Add CVE-2026-68742.diff, CVE-2026-68743.diff, and...
Mike Gabriel (@sunweaver)
gitlab at salsa.debian.org
Fri Sep 4 17:40:28 BST 2026
Mike Gabriel pushed to branch master at Debian SSSD packaging / sssd
Commits:
54e71c87 by Mike Gabriel at 2026-09-04T15:52:23+02:00
debian/patches: Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-2026-68744.diff (Closes: #1143600, #1143947).
CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr()
CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1()
CVE-2026-68744: NSS: fix initgroups packet heap disclosure
- - - - -
a5a35a52 by Mike Gabriel at 2026-09-04T18:39:41+02:00
releasing package sssd version 2.13.1-2
- - - - -
5 changed files:
- debian/changelog
- + debian/patches/CVE-2026-68742.diff
- + debian/patches/CVE-2026-68743.diff
- + debian/patches/CVE-2026-68744.diff
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,13 @@
+sssd (2.13.1-2) unstable; urgency=medium
+
+ * debian/patches: Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-
+ 2026-68744.diff. (Closes: #1143600, #1143947).
+ CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr()
+ CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1()
+ CVE-2026-68744: NSS: fix initgroups packet heap disclosure
+
+ -- Mike Gabriel <sunweaver at debian.org> Fri, 04 Sep 2026 15:54:27 +0200
+
sssd (2.13.1-1) unstable; urgency=medium
* Team upload.
=====================================
debian/patches/CVE-2026-68742.diff
=====================================
@@ -0,0 +1,53 @@
+From cb806786db2c7c7fc3b000fe824f761a7d8481e0 Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono at redhat.com>
+Date: Tue, 4 Aug 2026 20:08:28 +0200
+Subject: [PATCH] nss: validate addrlen in sss_nss_protocol_parse_addr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+:fixes: CVE-2026-68742
+
+Reviewed-by: Pavel Březina <pbrezina at redhat.com>
+Reviewed-by: Sumit Bose <sbose at redhat.com>
+(cherry picked from commit 2839e8ccffebbb6bd605047b012eaa5fdb56b9d3)
+---
+ src/responder/nss/nss_protocol.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/src/responder/nss/nss_protocol.c b/src/responder/nss/nss_protocol.c
+index e6dc7023bca..aa9eca37187 100644
+--- a/src/responder/nss/nss_protocol.c
++++ b/src/responder/nss/nss_protocol.c
+@@ -23,6 +23,8 @@
+ #include "lib/idmap/sss_idmap.h"
+ #include "responder/nss/nss_protocol.h"
+ #include <arpa/inet.h>
++#include <sys/socket.h>
++#include <arpa/nameser.h>
+
+ errno_t
+ sss_nss_protocol_done(struct cli_ctx *cli_ctx, errno_t error)
+@@ -467,6 +469,22 @@ sss_nss_protocol_parse_addr(struct cli_ctx *cli_ctx,
+ SAFEALIGN_COPY_UINT32(&af, body, NULL);
+ SAFEALIGN_COPY_UINT32(&addrlen, body + sizeof(uint32_t), NULL);
+
++ if (addrlen != blen - sizeof(uint32_t) * 2) {
++ return EINVAL;
++ }
++
++ if (af == AF_INET) {
++ if (addrlen != INADDRSZ) {
++ return EINVAL;
++ }
++ } else if (af == AF_INET6) {
++ if (addrlen != IN6ADDRSZ) {
++ return EINVAL;
++ }
++ } else {
++ return EINVAL;
++ }
++
+ addr = body + sizeof(uint32_t) * 2;
+
+ /* If the body isn't a addr, fail */
=====================================
debian/patches/CVE-2026-68743.diff
=====================================
@@ -0,0 +1,34 @@
+From 1ea0f2da77947598165da2b84202d355f43c9aa1 Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono at redhat.com>
+Date: Tue, 4 Aug 2026 20:51:07 +0200
+Subject: [PATCH] pam: validate auth_token_length in extract_authtok_v1()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The check mimics one existing in `extract_authtok_v2()`
+
+:fixes: CVE-2026-68743
+
+Assisted-By: Claude Code (Opus 4.6)
+Reviewed-by: Pavel Březina <pbrezina at redhat.com>
+Reviewed-by: Sumit Bose <sbose at redhat.com>
+(cherry picked from commit bef9d12617f22335e65447609a2724a68c1bf68a)
+---
+ src/responder/pam/pamsrv_cmd.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/src/responder/pam/pamsrv_cmd.c
++++ b/src/responder/pam/pamsrv_cmd.c
+@@ -450,6 +450,11 @@
+
+ SAFEALIGN_COPY_UINT32_CHECK(&auth_token_type, &body[*c], blen, c);
+ SAFEALIGN_COPY_UINT32_CHECK(&auth_token_length, &body[*c], blen, c);
++
++ if (*c + auth_token_length > blen || SIZE_T_OVERFLOW(*c, auth_token_length)) {
++ return EINVAL;
++ }
++
+ auth_token_data = body+(*c);
+
+ switch (auth_token_type) {
=====================================
debian/patches/CVE-2026-68744.diff
=====================================
@@ -0,0 +1,52 @@
+From 815d761330265484b2b8788742a3a81ace6d0484 Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono at redhat.com>
+Date: Mon, 3 Aug 2026 17:28:54 +0200
+Subject: [PATCH] NSS: fix initgroups packet heap disclosure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+sss_nss_protocol_fill_initgr() pre-allocates the reply packet for all
+group entries in result->count, but groups may be skipped when they are
+non-POSIX, incomplete, or filtered by the negative cache.
+Shrink the packet after filling it so it contains exactly the data that
+was written.
+
+:fixes: CVE-2026-68744
+
+Assisted-By: Claude Code (Opus 4.6)
+Reviewed-by: Pavel Březina <pbrezina at redhat.com>
+Reviewed-by: Sumit Bose <sbose at redhat.com>
+(cherry picked from commit f5be5002a2e43ff9d2a22a95ffe4e0eeb56e0d3d)
+---
+ src/responder/nss/nss_protocol_grent.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/src/responder/nss/nss_protocol_grent.c b/src/responder/nss/nss_protocol_grent.c
+index c2a0b93f80f..ed94b6665af 100644
+--- a/src/responder/nss/nss_protocol_grent.c
++++ b/src/responder/nss/nss_protocol_grent.c
+@@ -442,10 +442,7 @@ sss_nss_protocol_fill_initgr(struct sss_nss_ctx *nss_ctx,
+ }
+ }
+
+- if (orig_gid == 0) {
+- /* Initialize allocated memory to be safe and make Valgrind happy. */
+- SAFEALIGN_SET_UINT32(&body[rp], 0, &rp);
+- } else {
++ if (orig_gid != 0) {
+ /* Insert original primary group into the result. */
+ SAFEALIGN_COPY_UINT32(&body[rp], &orig_gid, &rp);
+ num_results++;
+@@ -473,5 +470,11 @@ sss_nss_protocol_fill_initgr(struct sss_nss_ctx *nss_ctx,
+ SAFEALIGN_COPY_UINT32(body, &num_results, NULL);
+ SAFEALIGN_SETMEM_UINT32(body + sizeof(uint32_t), 0, NULL); /* reserved */
+
++ /* Shrink packet to actual data size to avoid sending uninitialized heap. */
++ ret = sss_packet_set_size(packet, (2 + num_results) * sizeof(uint32_t));
++ if (ret != EOK) {
++ return ret;
++ }
++
+ return EOK;
+ }
=====================================
debian/patches/series
=====================================
@@ -6,3 +6,6 @@ fix-eol-flaws-in-codefiles.diff
CVE-2026-12610.diff
CVE-2026-14474.diff
CVE-2026-14476.diff
+CVE-2026-68742.diff
+CVE-2026-68743.diff
+CVE-2026-68744.diff
View it on GitLab: https://salsa.debian.org/sssd-team/sssd/-/compare/b30fbccb65846e4fef97b06b7cb547e0976f2c9b...a5a35a52bc37506146947cd8fcc4bfe32e653848
--
View it on GitLab: https://salsa.debian.org/sssd-team/sssd/-/compare/b30fbccb65846e4fef97b06b7cb547e0976f2c9b...a5a35a52bc37506146947cd8fcc4bfe32e653848
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-sssd-devel/attachments/20260904/00d5deb9/attachment-0001.htm>
More information about the Pkg-sssd-devel
mailing list