[31208] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix read overruns in SPNEGO parsing
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Feb 13 21:58:19 2023
From: ghudson@mit.edu
To: <cvs-krb5@mit.edu>
Message-ID: <20230214025707.0988410512A@krbdev.mit.edu>
Date: Mon, 13 Feb 2023 21:57:07 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/47c2a12830dbd7fb8e13c239ddc0ac74129a91f6
commit 47c2a12830dbd7fb8e13c239ddc0ac74129a91f6
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Feb 8 12:23:28 2023 -0500
Fix read overruns in SPNEGO parsing
Fix three read overruns discovered by the GitHub Security Lab team
(GHSL-2023-016, GHSL-2023-017, and GHSL-2023-018) using OSS-Fuzz.
In get_mech_set(), error out if gss_add_oid_set_member() fails rather
than continue the loop and increment i past the current bound of
returned_mechSet. In g_verify_neg_token_init(), check for zero-byte
sequences before reading tag bytes, and reduce cur_size by one to
account for the tag byte when calling gssint_get_der_length().
ticket: 9085 (new)
tags: pullup
target_version: 1.20-next
target_version: 1.19-next
src/lib/gssapi/spnego/spnego_mech.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index ba7765cb4..654964c62 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3455,7 +3455,7 @@ get_mech_set(OM_uint32 *minor_status, unsigned char **buff_in,
unsigned int buff_length)
{
gss_OID_set returned_mechSet;
- OM_uint32 major_status;
+ OM_uint32 major_status, tmpmin;
int length;
unsigned int bytes;
OM_uint32 set_length;
@@ -3485,9 +3485,12 @@ get_mech_set(OM_uint32 *minor_status, unsigned char **buff_in,
major_status = gss_add_oid_set_member(minor_status,
temp, &returned_mechSet);
- if (major_status == GSS_S_COMPLETE)
- set_length += returned_mechSet->elements[i].length +2;
generic_gss_release_oid(minor_status, &temp);
+ if (major_status != GSS_S_COMPLETE) {
+ gss_release_oid_set(&tmpmin, &returned_mechSet);
+ return (NULL);
+ }
+ set_length += returned_mechSet->elements[i].length + 2;
}
return (returned_mechSet);
@@ -4305,7 +4308,8 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size)
* - check for a0(context specific identifier)
* - get length and verify that enoughd ata exists
*/
- if (g_get_tag_and_length(&buf, CONTEXT, cur_size, &bytes) < 0)
+ if (g_get_tag_and_length(&buf, CONTEXT, cur_size, &bytes) < 0 ||
+ bytes == 0)
return (G_BAD_TOK_HEADER);
cur_size = bytes; /* should indicate bytes remaining */
@@ -4315,7 +4319,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size)
* a strucure of type NegTokenInit.
*/
if (*buf++ == SEQUENCE) {
- if ((seqsize = gssint_get_der_length(&buf, cur_size, &bytes)) < 0)
+ if ((seqsize = gssint_get_der_length(&buf, cur_size - 1, &bytes)) <= 0)
return (G_BAD_TOK_HEADER);
/*
* Make sure we have the entire buffer as described
@@ -4332,7 +4336,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size)
* Verify that the first blob is a sequence of mechTypes
*/
if (*buf++ == CONTEXT) {
- if ((seqsize = gssint_get_der_length(&buf, cur_size, &bytes)) < 0)
+ if ((seqsize = gssint_get_der_length(&buf, cur_size - 1, &bytes)) < 0)
return (G_BAD_TOK_HEADER);
/*
* Make sure we have the entire buffer as described
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
