Critical Vulnerability Patched in FreeIPA Domain Controller for Linux Systems

Red Dog Security

— 1 min read
Critical Vulnerability Patched in FreeIPA Domain Controller for Linux Systems

Red Hat has issued a patch for a critical vulnerability in FreeIPA, a widely used domain controller for Linux systems. The flaw—CVE-2025-4404, rated CVSS 9.4—was discovered by Mikhail Sukhov, a researcher at Positive Technologies.

FreeIPA is commonly deployed to manage user identities, authentication policies, and audit logging across enterprise Linux environments.

Key Details

  • Affected Versions: FreeIPA 4.12.2 and 4.12.3
  • Impact:
    An attacker with access to credentials from a compromised domain-joined machine can:
    • Extract authentication keys from system files
    • Escalate privileges to domain administrator
    • Gain control over all user accounts and organizational resources
  • Root Cause:
    A 2020 update removed the krbCanonicalName attribute, which was originally intended to prevent privilege escalation. This change introduced a new attack vector.

Exploitation Scenario

  1. An attacker compromises a domain-joined machine account.
  2. They access sensitive key files on the system.
  3. They use those keys to forge Kerberos tickets and impersonate a domain administrator (e.g., [email protected]).

Mitigation

Patch

🔧 Workaround (If Patching Is Delayed):

  • Enforce Privilege Attribute Certificate (PAC) validation on Kerberos servers.
  • Manually set [email protected] for admin accounts to block ticket forgery.

Why This Matters

FreeIPA is bundled with Red Hat Enterprise Linux, a platform used by over 2,000 organizations worldwide. It also underpins identity services in products from other vendors, including those in Russia.

Unpatched systems risk complete domain compromise, potentially allowing attackers to override access controls and exfiltrate sensitive data.

Expert Quote

"This flaw could turn a single compromised machine into a gateway for domain-wide control. Organizations must prioritize updates or enforce strict Kerberos PAC checks."
— Mikhail Sukhov, Positive Technologies

Action Items

  • Patch immediately if running FreeIPA ≤ 4.12.3
  • Audit Kerberos configurations to ensure PAC enforcement
  • Monitor logs for suspicious authentication or privilege escalation activity

Read more