CVE-2025-11561: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-11561 is a privilege escalation vulnerability in the System Security Services Daemon (SSSD) when integrated with Microsoft Active Directory on domain-joined Linux systems. The flaw arises because, in default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is not enabled, allowing a fallback to the an2ln plugin which performs insecure Kerberos principal-to-local-user mapping. An attacker with permission to modify certain Active Directory attributes (userPrincipalName or samAccountName) can impersonate privileged accounts such as root or Administrator. The vulnerability was disclosed on October 9, 2025, and affects SSSD across multiple Linux distributions including RHEL 7 through 10, Fedora, SUSE, Amazon Linux, and Oracle Linux. It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-269 (Improper Privilege Management). When SSSD is configured to use Active Directory as an identity provider and the sssd_krb5_localauth_plugin is absent or disabled, Kerberos authentication falls back to the an2ln (auth_to_local name) plugin for mapping Kerberos principals to local Unix accounts. This mapping can be manipulated by modifying the userPrincipalName or samAccountName AD attributes of a controlled account to match the Kerberos principal of a privileged local user (e.g., root). The attack is network-accessible, requires only low privileges (the ability to modify AD attributes), and no user interaction, making it exploitable via GSSAPI or password-based Kerberos authentication flows. A technical write-up is referenced at https://blog.async.sg/kerberos-ldr (Red Hat Bugzilla, ENISA EUVD).

Successful exploitation allows an attacker to impersonate privileged local accounts — including root — on any domain-joined Linux host running a vulnerable SSSD configuration, resulting in full compromise of confidentiality, integrity, and availability. An attacker gaining root-level access can read sensitive data, modify system configurations, install backdoors, and pivot laterally to other systems within the environment. The scope of affected assets is broad, encompassing all Linux systems joined to an Active Directory domain using SSSD in its default configuration across RHEL 7–10, Fedora, SUSE, Amazon Linux 2/AL2023, Oracle Linux, and IBM Netezza Appliance (Red Hat CVE, IBM Advisory).

1. Reconnaissance: Identify domain-joined Linux hosts running SSSD with Active Directory integration. Enumerate hosts via AD computer objects or network scanning. Confirm SSSD version and whether sssd_krb5_localauth_plugin is absent from the Kerberos configuration (/etc/krb5.conf).
2. Obtain AD write access: Acquire an Active Directory account with permission to modify userPrincipalName or samAccountName attributes on user objects. This may be a delegated helpdesk account or a compromised low-privilege domain user with self-service attribute modification rights.
3. Craft a malicious AD attribute: Modify the userPrincipalName or samAccountName of the controlled AD account to match the Kerberos principal that SSSD would map to a privileged local user (e.g., root@DOMAIN.COM or a value that the an2ln plugin resolves to root).
4. Authenticate to the target Linux host: Authenticate to the domain-joined Linux host using GSSAPI (e.g., SSH with Kerberos) or password-based Kerberos authentication using the manipulated account credentials.
5. Achieve privilege escalation: Because SSSD's fallback an2ln mapping resolves the crafted Kerberos principal to the privileged local account (e.g., root), the attacker gains a session with root-level privileges on the target system (Red Hat Bugzilla, ENISA EUVD).

• Logs: Authentication events in /var/log/sssd/sssd_*.log showing Kerberos principal-to-local-user mappings for privileged accounts (e.g., root) from unexpected AD user objects; PAM authentication logs (/var/log/secure or /var/log/auth.log) showing successful logins as root or other privileged users via Kerberos/GSSAPI from domain accounts.
• Active Directory: Unexpected or recent modifications to userPrincipalName or samAccountName attributes on AD user objects, particularly values resembling privileged local account names; AD audit logs showing attribute changes by low-privilege accounts.
• Network: SSH connections using GSSAPI (-o GSSAPIAuthentication=yes) to Linux hosts from accounts not normally associated with privileged access; Kerberos ticket-granting service (TGS) requests for service principals on Linux hosts from unusual AD accounts.
• File System: Presence of new SSH authorized keys, cron jobs, or SUID binaries created under root or other privileged accounts following a suspicious authentication event.
• Process: Unexpected privileged processes (shells, package managers, network tools) spawned under root or other privileged UIDs following a Kerberos authentication event.

The primary remediation is to apply vendor-supplied SSSD security updates. Red Hat has released patches across all affected RHEL versions: RHEL 8 via RHSA-2025:19610 (sssd-2.9.4-5.el8_10.3), RHEL 7 ELS via RHSA-2025:19847 (sssd-1.16.5-10.el7_9.17), RHEL 10 via RHSA-2025:19851, RHEL 9 via RHSA-2025:20954, and numerous additional advisories for RHEL 8.x/9.x point releases and Red Hat OpenShift Container Platform 4.12–4.20. SUSE patches are available via SUSE-SU-2025:4182-1 and SUSE-SU-2025:4247-1. Amazon Linux 2 is addressed in ALAS2-2025-3050 and AL2023 release notes. As a configuration-based workaround, administrators should explicitly enable the sssd_krb5_localauth_plugin in /etc/krb5.conf by adding it to the [plugins] section, and restrict AD delegation rights to prevent unauthorized modification of userPrincipalName and samAccountName attributes (Red Hat RHSA-2025:19610, Red Hat RHSA-2025:19847, Red Hat Bugzilla).

Red Hat rated the vulnerability as "Important" severity and issued a broad set of security advisories covering RHEL 7 through 10 and multiple OpenShift Container Platform versions, reflecting the wide deployment footprint of SSSD in enterprise Linux environments (Red Hat RHSA-2025:19610). SUSE also published a security lowdown blog post referencing the issue as part of their 2025 security summary (SUSE Blog). Community discussion was noted on Mastodon and infosec.exchange shortly after disclosure, and the vulnerability was picked up by security aggregators including ZeroPath, which published a dedicated blog post analyzing the AD authentication bypass (ZeroPath Blog). IBM issued a security bulletin confirming impact on IBM Netezza Appliance (IBM Advisory).