[31688] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Prevent null deref in KDC dispatch corner
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:04:04 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170237.9CBB5105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:02:37 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/e86ffb1de73ede86e48add92786dbdc08bb1b850
commit e86ffb1de73ede86e48add92786dbdc08bb1b850
Author: Greg Hudson <ghudson@mit.edu>
Date: Thu Sep 17 11:07:52 2026 -0400
Prevent null deref in KDC dispatch corner case
If a KDC request matches an entry in the lookaside cache, we transmit
the reply without decoding the request, and therefore without looking
up the applicable realm. But if the cached reply is longer than
kdc_max_dgram_reply_size, we need the applicable realm's TGS server
principal to construct a KRB_ERR_RESPONSE_TOO_BIG KRB-ERROR message.
Currently this results in a null derefernce. This case is unlikely to
happen with the default kdc_max_dgram_reply_size value of 65536, but
may be triggerable by an unauthenticated attacker if the value is
lowered. Prevent a null dereference in this scenario by setting an
initial guess at the realm before checking the lookaside cache.
Reported by AWS Security.
(cherry picked from commit 47d220edc71c8229e5fd7a36f3231273c8f06595)
ticket: 9238
version_fixed: 1.22.3
src/kdc/dispatch.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c
index 46b1c8b44..6f03e1724 100644
--- a/src/kdc/dispatch.c
+++ b/src/kdc/dispatch.c
@@ -109,6 +109,10 @@ dispatch(void *cb, const struct sockaddr *local_addr,
state->is_tcp = is_tcp;
state->kdc_err_context = kdc_err_context;
+ /* Start with a guess at the applicable realm, in case we need one to
+ * produce an error message without having decoded the request. */
+ state->active_realm = handle->kdc_realmlist[0];
+
/* decode incoming packet, and dispatch */
#ifndef NOCACHE
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
