[31671] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Free partial tl-data on XDR decode failure
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:01:54 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170117.F185C105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:01:17 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/bf47c9410127636b7e3d79a8135058ef5991599d
commit bf47c9410127636b7e3d79a8135058ef5991599d
Author: Julien Rische <jrische@redhat.com>
Date: Wed Jul 8 18:30:31 2026 +0200
Free partial tl-data on XDR decode failure
An XDR decoder may leave allocated memory in the caller's pointer on
failure, but may not entirely leak it. In xdr_krb5_tl_data(), free
the in-progress list and tl-data item on decode failure, as they are
stored in local variables and only assigned to *tl_data_head on
success.
[ghudson@mit.edu: rewrote patch to use goto label and xdr_free();
rewrote commit message]
CVE-2026-112316:
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka
krb5) does not free partially decoded data on failure, which allows
remote authenticated users to cause a denial of service (memory leak
in kadmind) via crafted RPC requests that trigger a decode failure.
(cherry picked from commit fe0a8a67f2fce89bb9d62031219a1f5a064c4df1)
ticket: 9255
version_fixed: 1.22.3
src/lib/kadm5/kadm_rpc_xdr.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
index 6a706dbd7..9387eba06 100644
--- a/src/lib/kadm5/kadm_rpc_xdr.c
+++ b/src/lib/kadm5/kadm_rpc_xdr.c
@@ -302,7 +302,7 @@ xdr_krb5_key_salt_tuple(XDR *xdrs, krb5_key_salt_tuple *objp)
bool_t xdr_krb5_tl_data(XDR *xdrs, krb5_tl_data **tl_data_head)
{
- krb5_tl_data *tl, *tl2;
+ krb5_tl_data *tl = NULL, *tl2 = NULL;
bool_t more;
unsigned int len;
@@ -340,22 +340,23 @@ bool_t xdr_krb5_tl_data(XDR *xdrs, krb5_tl_data **tl_data_head)
tl = NULL;
while (1) {
if (!xdr_bool(xdrs, &more))
- return FALSE;
+ goto decode_fail;
if (more == FALSE)
break;
tl2 = (krb5_tl_data *) malloc(sizeof(krb5_tl_data));
if (tl2 == NULL)
- return FALSE;
+ goto decode_fail;
memset(tl2, 0, sizeof(krb5_tl_data));
if (!xdr_krb5_int16(xdrs, &tl2->tl_data_type))
- return FALSE;
+ goto decode_fail;
if (!xdr_bytes(xdrs, (char **)&tl2->tl_data_contents, &len,
GSSRPC_MAX_ELEMENT_SIZE))
- return FALSE;
+ goto decode_fail;
tl2->tl_data_length = len;
tl2->tl_data_next = tl;
tl = tl2;
+ tl2 = NULL;
}
*tl_data_head = tl;
@@ -363,6 +364,11 @@ bool_t xdr_krb5_tl_data(XDR *xdrs, krb5_tl_data **tl_data_head)
}
return TRUE;
+
+decode_fail:
+ xdr_free((xdrproc_t)xdr_krb5_tl_data, &tl);
+ xdr_free((xdrproc_t)xdr_krb5_tl_data, &tl2);
+ return FALSE;
}
bool_t
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
