Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-f953-7679-xc38

Опубликовано: 30 июн. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 6.4

Описание

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

EPSS

Процентиль: 2%
0.00121
Низкий

6.4 Medium

CVSS3

Дефекты

CWE-825

Связанные уязвимости

CVSS3: 6.4
ubuntu
около 2 месяцев назад

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

CVSS3: 6.4
redhat
2 месяца назад

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

CVSS3: 6.4
nvd
около 2 месяцев назад

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

CVSS3: 6.4
debian
около 2 месяцев назад

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD ...

suse-cvrf
19 дней назад

Security update for sssd

EPSS

Процентиль: 2%
0.00121
Низкий

6.4 Medium

CVSS3

Дефекты

CWE-825