[31634] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix leak in RPC client on mismatched ID
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:58:00 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165750.D9C52105883@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:57:50 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/aac40ec59fd4ffa126e19749e85ddb913892fe53
commit aac40ec59fd4ffa126e19749e85ddb913892fe53
Author: Julien Rische <jrische@redhat.com>
Date: Thu Sep 3 17:49:25 2026 +0200
Fix leak in RPC client on mismatched ID
In clnttcp_call(), before decoding a reply, free the verifier in
reply_msg if one was allocated when decoding a previous reply.
[ghudson@mit.edu: moved ar_verf/ar_results setting back outside of
conditional; switched to using xdr_free() for brevity]
CVE-2026-112314:
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does
not free the RPC reply verifier between retries, which allows remote
attackers to cause a denial of service (memory leak in GSS-RPC client
programs) by injecting RPC replies with mismatched XIDs or by
triggering authentication retries.
ticket: 9258 (new)
tags: pullup
target_version: 1.22-next
src/lib/rpc/clnt_tcp.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/lib/rpc/clnt_tcp.c b/src/lib/rpc/clnt_tcp.c
index dbd62d0a7..2e058e58c 100644
--- a/src/lib/rpc/clnt_tcp.c
+++ b/src/lib/rpc/clnt_tcp.c
@@ -254,7 +254,7 @@ clnttcp_call(
{
struct ct_data *ct = h->cl_private;
XDR *xdrs = &ct->ct_xdrs;
- struct rpc_msg reply_msg;
+ struct rpc_msg reply_msg = { 0 };
uint32_t x_id;
uint32_t *msg_x_id = &ct->ct_u.ct_mcalli; /* yuk */
bool_t shipnow;
@@ -299,6 +299,11 @@ call_again:
*/
xdrs->x_op = XDR_DECODE;
while (TRUE) {
+ /* Free verifier buffer if set from previous decode. */
+ if (reply_msg.rm_reply.rp_stat == MSG_ACCEPTED) {
+ xdr_free((xdrproc_t)xdr_opaque_auth,
+ &reply_msg.acpted_rply.ar_verf);
+ }
reply_msg.acpted_rply.ar_verf = gssrpc__null_auth;
reply_msg.acpted_rply.ar_results.where = NULL;
reply_msg.acpted_rply.ar_results.proc = xdr_void;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
