Critical Privilege Escalation Vulnerability in SSSD Packages
Summary
ALSA-2025:20954: Important: sssd security update. Affects libipa_hbac versions < 2.9.7-4.el9_7.1. Fixed in 2.9.7-4.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The System Security Services Daemon (SSSD) is a crucial service that manages access to remote directories and authentication mechanisms on Linux systems. It provides interfaces for Name Service Switch (NSS) and Pluggable Authentication Modules (PAM), allowing seamless integration with various account sources. This vulnerability affects SSSD's default Kerberos configuration, potentially allowing unauthorized privilege escalation on Active Directory (AD)-joined Linux systems.
Vulnerability Detail
The vulnerability, identified as CVE-2025-11561, arises from the default Kerberos configuration in SSSD, which can be exploited to escalate privileges on systems that are joined to Active Directory. This could allow an attacker to gain unauthorized access to sensitive data or execute arbitrary commands with elevated privileges, posing a significant security risk to affected systems.
How To Fix
Minimum fixed version
2.9.7-4.el9_7.1
This is the first release that contains the fix.
sudo dnf update libipa_hbacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can review and modify the Kerberos configuration settings to mitigate the risk of privilege escalation until the packages are updated. Specific configurations may vary based on the environment and should be tested in a safe manner.
Conclusion
The SSSD vulnerability CVE-2025-11561 poses a significant risk of privilege escalation on AD-joined Linux systems. It is crucial for system administrators to update their packages to the patched version to safeguard against potential exploitation. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libipa_hbac →
FAQ
CVE-2025-11561 is a vulnerability in the SSSD service that allows for privilege escalation on AD-joined Linux systems due to a default Kerberos configuration.
You can use the Vulert platform to check if your application is affected by this vulnerability without requiring any installation. Simply upload your manifest file, such as package-lock.json, to monitor for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data and the ability to execute commands with elevated privileges, compromising system integrity.
Yes, a patch is available in version 2.9.7-4.el9_7.1 for the affected SSSD packages. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, consider reviewing and adjusting your Kerberos configuration as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libipa_hbac.
