PAM: fix use-after-free during p11_child processing - #8861
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the pam_check_cert_send function and the pam_check_cert_state structure to accept and store the full pam_ctx context instead of only the sss_certmap_ctx member. This allows for cleaner context management and potential future extensions. I have no feedback to provide as the changes are straightforward and correct.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
sumit-bose
left a comment
sumit-bose
left a comment
There was a problem hiding this comment.
Hi,
thank you for the fix, ACK.
bye,
Sumit
e3e0059 to
8a18f27
Compare
|
Added |
`pam_check_cert_send()` stored `pctx->sss_certmap_ctx` in the request state. If `p11_refresh_certmap_ctx()` ran while `p11_child` was still executing (e.g. triggered by a domain refresh), it freed and replaced the certmap context, leaving the request state holding a dangling pointer. `p11_child_done()` could later use that pointer. Fix this by passing the `pam_ctx` into `pam_check_cert_send()` and dereferencing `pctx->sss_certmap_ctx` at the time it is actually needed in `p11_child_done()`, so the current context is always used. Resolves: SSSD#8796 Fixes: CVE-2026-12610 Assisted-By: Claude Code (Opus 4.6) Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
8a18f27 to
094aa5f
Compare
4 participants
pam_check_cert_send()storedpctx->sss_certmap_ctxin the request state. Ifp11_refresh_certmap_ctx()ran whilep11_childwas still executing (e.g. triggered by a domain refresh), it freed and replaced the certmap context, leaving the request state holding a dangling pointer.p11_child_done()could later use that pointer.Fix this by passing the
pam_ctxintopam_check_cert_send()and dereferencingpctx->sss_certmap_ctxat the time it is actually needed inp11_child_done(), so the current context is always used.Resolves: #8796
Assisted-By: Claude Code (Opus 4.6)