CVE-2026-68744
published 2026-08-04CVE-2026-68744: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.13%
2.5th percentile
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
vendor_redhat·2026-08-03·CVSS 3.3
CVE-2026-68744 [LOW] CWE-908 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
Statement: This issue can only be triggered by a local attacker who can connect to the SSSD NSS responder unix socket. The disclosed data is limited to directory-level information and process heap layout from the sssd_nss process. Credentials, hashes, and tickets reside in separate sssd_pam and sssd_be processes and are not exposed by t
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-08-04
CVE-2026-68744 [LOW] CWE-908 A flaw was found in SSSD.
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all]
bugzilla·2026-08-03
CVE-2026-68744 [LOW] CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all]
CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder (src/responder/nss/nss_protocol_grent.c) pre-allocates the reply packet for all group entries using sss_packet_grow() but does not shrink the packet when groups are skipped (non-POSIX, incomplete, or filtered groups). sss_packet_grow() uses talloc_realloc_size(), which does not zero-fill newly allocated memory. The trailing unwritten bytes therefore contain uninitialized heap
Bugzilla
CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
bugzilla·2026-07-31
CVE-2026-68744 [LOW] CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder (src/responder/nss/nss_protocol_grent.c) pre-allocates the reply packet for all group entries using sss_packet_grow() but does not shrink the packet when groups are skipped (non-POSIX, incomplete, or filtered groups). sss_packet_grow() uses talloc_realloc_size(), which does not zero-fill newly allocated memory. The trailing unwritten bytes therefore contain uninitialized heap data from the sssd_nss process and are transmitted to the client at the grown packet length. A local attacker can exploit this by sending SSS_NSS_INITGR (0x0026) requests to the world-writable NSS responder socket (/var/lib/sss/pipes/nss)
2026-08-04
Published