[31667] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix leaks in lifecycle of RPCSEC_GSS context
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:01:44 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170139.E8C5E105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:01:39 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/31ebc4d7650e77d9b8378f486047507970688674
commit 31ebc4d7650e77d9b8378f486047507970688674
Author: Julien Rische <jrische@redhat.com>
Date: Fri Sep 4 11:30:45 2026 +0200
Fix leaks in lifecycle of RPCSEC_GSS context
In svcauth_gss_accept_sec_context(), if gss_accept_sec_context()
yields a src_name and returns GSS_S_CONTINUE_NEEDED, free the stored
gd->cname before making the next call. If gss_accept_sec_context()
returns an error for an existing context, do not leak gd->ctx. In the
unlikely event that gss_accept_sec_context() returns GSS_S_COMPLETE
multiple times, release gd->cname before calling gss_display_name()
again.
In gssrpc__svcauth_gss(), reject RPCSEC_GSS_INIT and
RPCSEC_GSS_CONTINUE_INIT requests if a context is already established.
[ghudson@mit.edu: added gd->established check; removed change to
delete existing context on error return; rewrote commit message]
(cherry picked from commit 21e981c73df78eaa1df367a97ad31ac848233a89)
ticket: 9267
version_fixed: 1.22.3
src/lib/rpc/svc_auth_gss.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c
index 8f012c891..aafa54f16 100644
--- a/src/lib/rpc/svc_auth_gss.c
+++ b/src/lib/rpc/svc_auth_gss.c
@@ -197,6 +197,10 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst,
(caddr_t)&recv_tok))
return (FALSE);
+ /* Release any prior client name from a previous call. */
+ gss_release_name(&min_stat, &gd->client_name);
+ gd->client_name = GSS_C_NO_NAME;
+
gr->gr_major = gss_accept_sec_context(&gr->gr_minor,
&gd->ctx,
gd->cred,
@@ -216,7 +220,6 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst,
if (gr->gr_major != GSS_S_COMPLETE &&
gr->gr_major != GSS_S_CONTINUE_NEEDED) {
badauth(gr->gr_major, gr->gr_minor, rqst->rq_xprt);
- gd->ctx = GSS_C_NO_CONTEXT;
goto errout;
}
gr->gr_ctx.value = "xxxx";
@@ -237,6 +240,8 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst,
/* spkm3: no src_name (anonymous) */
if(!g_OID_equal(gss_mech_spkm3, mech)) {
#endif
+ /* Release any prior name in case we get here twice. */
+ gss_release_buffer(&min_stat, &gd->cname);
maj_stat = gss_display_name(&min_stat, gd->client_name,
&gd->cname, &gd->sec.mech);
#ifdef SPKM
@@ -490,6 +495,9 @@ gssrpc__svcauth_gss(struct svc_req *rqst, struct rpc_msg *msg,
if (!svcauth_gss_acquire_cred(gd))
ret_freegc (AUTH_FAILED);
+ if (gd->established)
+ ret_freegc (AUTH_FAILED);
+
if (!svcauth_gss_accept_sec_context(rqst, &gr))
ret_freegc (AUTH_REJECTEDCRED);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
