RHBA-2018:1986 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs are now available for Red Hat
Enterprise Linux 7.

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

This update fixes the following bugs:

• Previously, if a large group was requested through the sssd_nss_ex interface, the buffer used inside the SSSD had to be relocated to be able to hold all the group members. However, when SSSD wanted to free this buffer, it used the address of the original memory, not the reallocated one. Because SSSD freed the original memory address, not the new one returned by the function that reallocates the memory, the Red Hat Directory Server (RHDS) sometimes terminated unexpectedly. The reason for this is that the sssd API is called from the context of RHDS. With this update, the SSSD code has been modified to free the reallocated memory. As a result, no crash that would manifest as a crash of RHDS happens in the SSSD code. (BZ#1570527)
• The sssd_nss module calls a free function when the lifetime of a netgroup representation expires. Additionally, administrators can manually expire netgroups using the sssd_cache utility. However, after this manual expiration, SSSD called the function again when the lifetime expired. As a consequence, the function was called twice and resulted in a double-free memory error. With this update, the free function is no longer called when the administrator uses the sssd_cache utility. Instead it removes the netgroup from the list of known netgroups and later, when the netgroup reaches its lifetime, it is removed from memory. As a result, the double-free error no longer occurs. (BZ#1579703)
• Previously, an RPM macro that is supposed to restart SSSD after an upgrade was placed into a section where the condition that enables this scriptlet was never true. As a consequence, the sssd service did not restart automatically during the upgrade from 7.4 to 7.5. With this update, the sssd service is now restarted explicitly instead of using the macro that was previously used. As a result, the sssd service now restarts after an upgrade. (BZ#1579780)
• Previously, the new Samba version in Red Hat Enterprise Linux 7.5 used a newer version of the idmap plug-in interface and SSSD still provided a plug-in with an older version. If Samba was configured to use SSSD's idmap plug-in, smdb and winbind services failed to start due to the version mismatch. With this update, SSSD provides a plug-in with a matching version. As a result, smdb and winbind run as expected. (BZ#1580281)
• Previously, when the sssd_be process searched for Identity Management (IDM) groups that contained external, typically Active Directory, groups as their members, it allocated the result on a memory context that was used through the lifetime of sssd_be. As a consequence, the memory usage of sssd_be was continuously growing. With this update, more appropriate memory context owns the memory and frees it when necessary. As a result, sssd_be memory usage no longer grows with searching for IDM groups with external members. (BZ#1583746)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1570527 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash [rhel-7.5.z]
• BZ - 1579703 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000] [rhel-7.5.z]
• BZ - 1579780 - After updating to RHEL 7.5 failing to clear the sssd cache [rhel-7.5.z]
• BZ - 1580281 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION [rhel-7.5.z]

CVEs

(none)

References

(none)