CVE-2025-11561 Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems
A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.0
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7 Extended Lifecycle Support
cpes: cpe:/o:redhat:rhel_els:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/o:redhat:rhel_aus:8.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
cpes: cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
cpes: cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/o:redhat:rhel_tus:8.6::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
cpes: cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/o:redhat:rhel_tus:8.6::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
cpes: cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/o:redhat:rhel_tus:8.6::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service
cpes: cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:rhel_tus:8.8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
cpes: cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:rhel_tus:8.8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/o:redhat:rhel_e4s:9.0::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::crb
cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/o:redhat:rhel_eus:9.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.6 Extended Update Support
cpes: cpe:/o:redhat:rhel_eus:9.6::baseos
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/a:redhat:rhel_eus:9.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.12
cpes: cpe:/a:redhat:openshift:4.12::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.13
cpes: cpe:/a:redhat:openshift:4.13::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.14
cpes: cpe:/a:redhat:openshift:4.14::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.15
cpes: cpe:/a:redhat:openshift:4.15::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.16
cpes: cpe:/a:redhat:openshift:4.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.17
cpes: cpe:/a:redhat:openshift:4.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.18
cpes: cpe:/a:redhat:openshift:4.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.19
cpes: cpe:/a:redhat:openshift:4.19::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.20
cpes: cpe:/a:redhat:openshift:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 7
cpes: cpe:/a:redhat:ceph_storage:7::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 8
cpes: cpe:/a:redhat:ceph_storage:8::el9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Zavier Lee for reporting this issue.
Published: 2025-10-09T13:37:53.089Z