rpms/sssd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebuild SSSD for RHEL 9.9 with CVEs 2026-14474 + 2026-14476

Browse Source 
- Resolves: RHEL-192062 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
- Resolves: RHEL-192072 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root
This commit is contained in:
Justin Stephenson 2026-07-08 10:24:43 -04:00
parent 1465c564b5
commit 5a077ab68b
3 changed files with 265 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

176
0003-gpo-reject-path-traversal-in-gPCFileSysPath.patch Normal file
View File

@ -0,0 +1,176 @@
From 91017d89f44da47ae16c140e94a5bcafc43badb5 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 2 Jul 2026 17:29:51 +0200
Subject: [PATCH 1/2] gpo: reject path traversal in gPCFileSysPath
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed
by ad_gpo_extract_smb_components() which converts backslashes to forward
slashes but does not reject ".." path traversal sequences. The resulting
smb_path is used directly in gpo_cache_store_file() to construct a local
filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO
write access to write files outside the cache directory.
Due to differential path resolution between libsmbclient (which clamps
".." at the SMB share root) and the kernel (which resolves ".." fully),
the SMB download succeeds while the local file write escapes the cache.
On systems with SELinux enforcing, this enables Kerberos configuration
injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t,
writable by sssd_t). On systems without SELinux, this enables arbitrary
file writes including cron job injection for root code execution.
This patch adds two layers of defense:
1. Reject ".." as a path component in smb_path at parse time in
ad_gpo_extract_smb_components(). Uses component-aware validation
that checks for "/..", "../", and exact ".." — not substring matching
which would false-positive on legitimate names containing "..".
2. Validate the resolved cache path stays within GPO_CACHE_PATH in
gpo_cache_store_file() using realpath(), with a trailing-slash
prefix check to prevent prefix-collision attacks (e.g.,
/var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache).
Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>
:fixes: CVE-2026-14476
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
(cherry picked from commit ba207eab76ff5253662a763b9b6e9ea42f03d31b)
---
src/providers/ad/ad_gpo.c | 47 +++++++++++++++++++++++++++++++
src/providers/ad/ad_gpo_child.c | 49 +++++++++++++++++++++++++++++++++
2 files changed, 96 insertions(+)
diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
index 82c6e73a0..4a4d21d45 100644
--- a/src/providers/ad/ad_gpo.c
+++ b/src/providers/ad/ad_gpo.c
@@ -3838,6 +3838,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
return ret;
}
+/*
+ * Check whether a path contains ".." as a path component.
+ * Returns true if traversal is detected, false if the path is safe.
+ *
+ * Checks for:
+ * - "/.." anywhere in the path (component starting with ..)
+ * - "../" at the start of the path
+ * - exact match ".." (path is just "..")
+ * - "/.." at the end of the path
+ *
+ * Does NOT match ".." as a substring of a longer component
+ * (e.g., "my..file" is allowed).
+ */
+static bool gpo_path_has_traversal(const char *path)
+{
+ const char *p;
+
+ if (path == NULL) {
+ return false;
+ }
+
+ /* Exact match */
+ if (strcmp(path, "..") == 0) return true;
+
+ /* Starts with ../ */
+ if (strncmp(path, "../", 3) == 0) return true;
+
+ /* Contains /../ or ends with /.. */
+ p = path;
+ while ((p = strstr(p, "/..")) != NULL) {
+ if (p[3] == '/' || p[3] == '\0') return true;
+ p += 3;
+ }
+
+ return false;
+}
+
/*
* This function parses the input_path into its components, replaces each
* back slash ('\') with a forward slash ('/'), and populates the output params.
@@ -3914,6 +3951,16 @@ ad_gpo_extract_smb_components(TALLOC_CTX *mem_ctx,
goto done;
}
+ /* Reject path traversal. See function comment for what is matched. */
+ if (gpo_path_has_traversal(smb_path)) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "gPCFileSysPath contains path traversal component '..': "
+ "[%s]. Rejecting to prevent cache directory escape.\n",
+ smb_path);
+ ret = EINVAL;
+ goto done;
+ }
+
*_smb_server = talloc_asprintf(mem_ctx, "%s%s",
SMB_STANDARD_URI,
server_hostname);
diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c
index 4ad0fcf48..5b3d4fcfb 100644
--- a/src/providers/ad/ad_gpo_child.c
+++ b/src/providers/ad/ad_gpo_child.c
@@ -321,6 +321,55 @@ static errno_t gpo_cache_store_file(const char *smb_path,
goto done;
}
+ /* Defense-in-depth: verify the resolved path stays within the cache
+ * directory (when updating existing files). This catches any bypass
+ * of the ".." check in the parser, including encoding tricks, symlink
+ * attacks, or future regressions.
+ *
+ * The trailing-slash comparison prevents prefix-collision attacks:
+ * without it, a path resolving to "/var/lib/sss/gpo_cache_evil/"
+ * would incorrectly match the prefix "/var/lib/sss/gpo_cache".
+ */
+ {
+ char *resolved = realpath(filename, NULL);
+ if (resolved != NULL) {
+ /* Resolve GPO_CACHE_PATH too so the comparison works
+ * even when the cache path contains symlinks. */
+ char *resolved_cache = realpath(GPO_CACHE_PATH, NULL);
+ if (resolved_cache == NULL) {
+ ret = errno;
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "realpath(\"%s\") failed: [%d][%s]\n",
+ GPO_CACHE_PATH, ret, strerror(ret));
+ free(resolved);
+ goto done;
+ }
+
+ /* Check that resolved path starts with resolved cache + "/" */
+ size_t cache_len = strlen(resolved_cache);
+ bool inside = ((strlen(resolved) >= cache_len) &&
+ (strncmp(resolved, resolved_cache, cache_len) == 0) &&
+ (resolved[cache_len] == '/' || resolved[cache_len] == '\0'));
+ if (!inside) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "GPO cache path escapes cache directory: [%s] "
+ "resolves to [%s] which is outside [%s]. "
+ "Rejecting.\n",
+ filename, resolved, resolved_cache);
+ free(resolved_cache);
+ free(resolved);
+ ret = EINVAL;
+ goto done;
+ }
+ free(resolved_cache);
+ free(resolved);
+ }
+ /* If realpath returns NULL, the path doesn't exist yet.
+ * prepare_gpo_cache() will create it — the mkdir calls
+ * are validated by SELinux MAC policy.
+ */
+ }
+
tmp_name = talloc_asprintf(tmp_ctx, "%sXXXXXX", filename);
if (tmp_name == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
--
2.54.0

82
0004-sudo-warn-when-ldap_sudo_search_base-falls-back-to-root-DN.patch Normal file
View File

@ -0,0 +1,82 @@
From 71f52c4a112b9a2e0e07b348ce28170cc673d532 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 3 Jul 2026 13:25:08 +0200
Subject: [PATCH 2/2] sudo: warn when ldap_sudo_search_base falls back to root
DN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When ldap_sudo_search_base is not explicitly configured, SSSD falls back
to the domain's naming context (root DN) and searches the entire LDAP
directory tree for sudoRole objects. Any LDAP principal with write access
to any subtree can inject a sudoRole granting arbitrary sudo privileges
on every enrolled host.
This patch adds a warning log when the fallback occurs, alerting
administrators that their configuration searches the entire directory
tree for sudo rules. A future hardening step would be to default to
ou=sudoers,<base_dn> instead of the root DN.
The warning approach preserves backwards compatibility while ensuring
administrators are aware of the security implications.
Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>
:fixes: CVE-2026-14474
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d)
---
src/providers/ldap/sdap.c | 19 +++++++++++++++++++
src/tests/system/tests/test_ldap.py | 2 +-
2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index ef7b19049..09445f0c8 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -1314,6 +1314,25 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
/* Sudo */
if (!sdom->sudo_search_bases) {
+ /* At some point make this option mandatory,
+ * i.e. disable sudo rules lookup if 'sudo_search_bases' not set.
+ */
+ DEBUG(SSSDBG_IMPORTANT_INFO,
+ "`ldap_sudo_search_base` is not set. SSSD will search the entire "
+ "directory tree (%s) for sudoRole objects. This may allow any "
+ "LDAP principal with write access to any subtree to inject "
+ "sudo rules granting arbitrary privileges. Set "
+ "`ldap_sudo_search_base` to restrict the search scope "
+ "(e.g., 'ou=sudoers,dc=example,dc=com').\n",
+ sdom->naming_context);
+ sss_log(SSS_LOG_ALERT,
+ "`ldap_sudo_search_base` is not set. SSSD will search the entire "
+ "directory tree (%s) for sudoRole objects. This may allow any "
+ "LDAP principal with write access to any subtree to inject "
+ "sudo rules granting arbitrary privileges. Set "
+ "`ldap_sudo_search_base` to restrict the search scope "
+ "(e.g., 'ou=sudoers,dc=example,dc=com').",
+ sdom->naming_context);
ret = sdap_set_search_base(opts, sdom,
SDAP_SUDO_SEARCH_BASE,
sdom->naming_context);
diff --git a/src/tests/system/tests/test_ldap.py b/src/tests/system/tests/test_ldap.py
index 15b505b3d..646dffb0f 100644
--- a/src/tests/system/tests/test_ldap.py
+++ b/src/tests/system/tests/test_ldap.py
@@ -137,7 +137,7 @@ def test_ldap__search_base_is_discovered_and_defaults_to_root_dse(client: Client
client.sssd.dom("test")["ldap_search_base"] = ldap.ldap.naming_context
client.sssd.stop()
- client.sssd.clear()
+ client.sssd.clear(logs=True)
client.sssd.start()
assert client.auth.ssh.password("puser1", "Secret123"), "User 'puser1' login failed!"
--
2.54.0

8
sssd.spec
View File

@ -27,7 +27,7 @@
Name: sssd
Version: 2.9.9
Release: 2%{?dist}
Release: 3%{?dist}
Summary: System Security Services Daemon
License: GPLv3+
URL: https://github.com/SSSD/sssd/
@ -36,6 +36,8 @@ Source0: https://github.com/SSSD/sssd/releases/download/%{version}/sssd-%{versio
### Patches ###
Patch1: 0001-passwordless-gdm.patch
Patch2: 0002-sysdb-enumpwent-replacement.patch
Patch3: 0003-gpo-reject-path-traversal-in-gPCFileSysPath.patch
Patch4: 0004-sudo-warn-when-ldap_sudo_search_base-falls-back-to-root-DN.patch
### Dependencies ###
@ -1085,6 +1087,10 @@ fi
%systemd_postun_with_restart sssd.service
%changelog
* Wed Jul 8 2026 Justin Stephenson <jstephen@redhat.com> - 2.9.9-3
- Resolves: RHEL-192062 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
- Resolves: RHEL-192072 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root
* Thu Jun 4 2026 Pavel Březina <pbrezina@redhat.com> - 2.9.9-2
- Rebuild against samba-4.24