[31672] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Prevent null dereferences in kadmind server
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:01:58 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170153.08D76105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:01:53 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/bdd63af8891377580474b3f7002e8d8cf5378d46
commit bdd63af8891377580474b3f7002e8d8cf5378d46
Author: Greg Hudson <ghudson@mit.edu>
Date: Tue Oct 20 12:00:23 2026 -0400
Prevent null dereferences in kadmind server stubs
In server_stubs.c, when a stub function uses a policy name as
prime_arg, check for a null value and return an error.
CVE-2026-112318:
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5
(aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by
xdr_nullstring(), which allows remote authenticated users to cause a
denial of service (kadmind crash via NULL pointer dereference) by
sending a policy request with an empty policy name that reaches
authorization checks or logging code.
(cherry picked from commit 407e75e927c1870161305d3288cc0205e9ff067b)
ticket: 9265
version_fixed: 1.22.3
src/kadmin/server/server_stubs.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
index 7fd980794..e36c91322 100644
--- a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -1261,6 +1261,10 @@ create_policy_2_svc(cpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
goto exit_func;
prime_arg = arg->rec.policy;
+ if (prime_arg == NULL) {
+ ret->code = EINVAL;
+ goto exit_func;
+ }
if (CHANGEPW_SERVICE(rqstp) ||
!stub_auth_pol(handle, OP_ADDPOL, arg->rec.policy,
@@ -1274,8 +1278,7 @@ create_policy_2_svc(cpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
if (ret->code != 0)
errmsg = krb5_get_error_message(handle->context, ret->code);
- log_done("kadm5_create_policy",
- ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
+ log_done("kadm5_create_policy", prime_arg, errmsg,
&client_name, &service_name, rqstp);
if (errmsg != NULL)
@@ -1303,6 +1306,10 @@ delete_policy_2_svc(dpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
goto exit_func;
prime_arg = arg->name;
+ if (prime_arg == NULL) {
+ ret->code = EINVAL;
+ goto exit_func;
+ }
if (CHANGEPW_SERVICE(rqstp) ||
!stub_auth(handle, OP_DELPOL, NULL, NULL, arg->name, NULL)) {
@@ -1314,8 +1321,7 @@ delete_policy_2_svc(dpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
if (ret->code != 0)
errmsg = krb5_get_error_message(handle->context, ret->code);
- log_done("kadm5_delete_policy",
- ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
+ log_done("kadm5_delete_policy", prime_arg, errmsg,
&client_name, &service_name, rqstp);
if (errmsg != NULL)
@@ -1343,6 +1349,10 @@ modify_policy_2_svc(mpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
goto exit_func;
prime_arg = arg->rec.policy;
+ if (prime_arg == NULL) {
+ ret->code = EINVAL;
+ goto exit_func;
+ }
if (CHANGEPW_SERVICE(rqstp) ||
!stub_auth_pol(handle, OP_MODPOL, arg->rec.policy,
@@ -1355,8 +1365,7 @@ modify_policy_2_svc(mpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
if (ret->code != 0)
errmsg = krb5_get_error_message(handle->context, ret->code);
- log_done("kadm5_modify_policy",
- ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
+ log_done("kadm5_modify_policy", prime_arg, errmsg,
&client_name, &service_name, rqstp);
if (errmsg != NULL)
@@ -1390,6 +1399,10 @@ get_policy_2_svc(gpol_arg *arg, gpol_ret *ret, struct svc_req *rqstp)
funcname = "kadm5_get_policy";
prime_arg = arg->name;
+ if (prime_arg == NULL) {
+ ret->code = EINVAL;
+ goto exit_func;
+ }
/* Look up the client principal's policy value. */
ret2 = kadm5_get_principal(handle->lhandle, handle->current_caller,
@@ -1408,9 +1421,8 @@ get_policy_2_svc(gpol_arg *arg, gpol_ret *ret, struct svc_req *rqstp)
if (ret->code != 0)
errmsg = krb5_get_error_message(handle->context, ret->code);
- log_done(funcname,
- ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
- &client_name, &service_name, rqstp);
+ log_done(funcname, prime_arg, errmsg, &client_name, &service_name,
+ rqstp);
if (errmsg != NULL)
krb5_free_error_message(handle->context, errmsg);
}
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
