[31642] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix leak on error in krb5_ktkdb_get_entry()
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:59:00 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165853.937E4105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:58:53 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/5d79291d7d6732b31a759493a5c0365ed208521a
commit 5d79291d7d6732b31a759493a5c0365ed208521a
Author: Julien Rische <jrische@redhat.com>
Date: Tue Oct 20 18:59:01 2026 +0200
Fix leak on error in krb5_ktkdb_get_entry()
Decrypt the keyblock into a local variable. On success, transfer
memory ownership to entry->key. On failure, free it in the cleanup
handler.
[ghudson@mit.edu: minor style edits]
CVE-2026-112317:
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka
krb5) 1.2.8 and later does not free decrypted key material when a
post-decryption check fails, which allows remote attackers to cause a
denial of service (memory leak in the KDC or kadmind) via requests
that repeatedly trigger key decryption failures.
ticket: 9268 (new)
tags: pullup
target_version: 1.22-next
src/lib/kdb/keytab.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/src/lib/kdb/keytab.c b/src/lib/kdb/keytab.c
index 346cf962e..0624b6ebd 100644
--- a/src/lib/kdb/keytab.c
+++ b/src/lib/kdb/keytab.c
@@ -122,6 +122,7 @@ krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
krb5_error_code kerror = 0;
krb5_key_data * key_data;
krb5_db_entry * db_entry;
+ krb5_keyblock kb = { 0 };
int xrealm_tgt;
krb5_boolean similar;
@@ -163,14 +164,13 @@ krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
goto error;
- kerror = krb5_dbe_decrypt_key_data(context, NULL, key_data,
- &entry->key, NULL);
+ kerror = krb5_dbe_decrypt_key_data(context, NULL, key_data, &kb, NULL);
if (kerror)
goto error;
if (enctype > 0) {
- kerror = krb5_c_enctype_compare(context, enctype,
- entry->key.enctype, &similar);
+ kerror = krb5_c_enctype_compare(context, enctype, kb.enctype,
+ &similar);
if (kerror)
goto error;
@@ -183,14 +183,19 @@ krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
* Coerce the enctype of the output keyblock in case we got an
* inexact match on the enctype.
*/
- entry->key.enctype = enctype;
+ kb.enctype = enctype;
kerror = krb5_copy_principal(context, principal, &entry->principal);
if (kerror)
goto error;
+ /* Transfer ownership of kb to entry. */
+ entry->key = kb;
+ memset(&kb, 0, sizeof(kb));
+
/* Close database */
error:
+ krb5_free_keyblock_contents(context, &kb);
krb5_db_free_principal(context, db_entry);
/* krb5_db_close_database(context); */
return(kerror);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
