Описание
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
Отчет
The SSSD IdP authentication provider was introduced in upstream sssd-2.11.0 (commit cf3a1d85). Red Hat Enterprise Linux 10.2 is the first and only RHEL version that ships the IdP provider feature. RHEL 10.1, despite shipping sssd-2.11, did not build the IdP provider component. All earlier RHEL versions (7, 8, 9) ship SSSD versions that predate the IdP provider and are therefore not affected. Exploitation requires SSSD to be configured with id_provider = idp and auth_provider = idp using Keycloak with LDAP User Federation in "Import Users = false" mode (non-default). In this configuration, Keycloak uses username-derived identifiers as the OIDC sub claim rather than random UUIDs, which can produce prefix relationships between user identifiers (e.g., "admin" vs "administrator"). The attacker requires only an ordinary IdP user account whose identifier is a strict prefix of the target's — no administrative or privileged access is needed. The default Keycloak LDAP federation mode (Import Users = true) assigns random UUIDs that prevent prefix collisions, substantially reducing exposure.
Меры по смягчению последствий
Deployments not using the IdP authentication provider (idp_type = keycloak) are not affected. For affected deployments: (1) If using Keycloak LDAP federation, switching to Import Users: enabled mode causes Keycloak to assign random UUIDs as sub claims, making prefix collisions astronomically unlikely. (2) Restrict PAM login to specific users via simple_allow_users or access_provider = simple. (3) Disable Keycloak self-registration to prevent attackers from creating accounts with chosen prefix usernames.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | sssd | Affected | ||
| Red Hat Enterprise Linux 6 | sssd | Out of support scope | ||
| Red Hat Enterprise Linux 7 | sssd | Not affected | ||
| Red Hat Enterprise Linux 8 | sssd | Not affected | ||
| Red Hat Enterprise Linux 9 | sssd | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
(A flaw was found in SSSD's IdP authentication provider. The eval_acces ...)
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
A flaw was found in SSSD's IdP authentication provider. The eval_acces ...
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
EPSS
7.5 High
CVSS3