[31690] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix RPC leak when client switches from
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:04:05 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170107.BBFB9105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:01:07 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/695e8966a6b8750b37f70b0b7d5bc63a221ada07
commit 695e8966a6b8750b37f70b0b7d5bc63a221ada07
Author: Julien Rische <jrische@redhat.com>
Date: Thu Sep 3 14:18:34 2026 +0200
Fix RPC leak when client switches from RPCSEC_GSS
svc_do_xprt() currently retains xp_auth across calls for RPCSEC_GSS.
Consequently, there may be a pre-existing xp_auth value when
gssrpc__authenticate() begins. If the client switches to a different
auth flavor, we must destroy the pre-existing xp_auth value or the new
auth handler will overwrite it and leak its contents.
[ghudson@mit.edu: edited commit message and comment]
CVE-2026-112320:
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later
does not release the previous authentication context when a client
switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor
on the same TCP connection. This allows remote attackers to cause a
denial of service (memory exhaustion in kadmind) by repeatedly
establishing and abandoning GSS authentication contexts.
(cherry picked from commit c4288c4a2fd477f60b9390ca5a7db442055e679b)
ticket: 9247
version_fixed: 1.22.3
src/lib/rpc/svc_auth.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/lib/rpc/svc_auth.c b/src/lib/rpc/svc_auth.c
index 2df9cf481..d240d2044 100644
--- a/src/lib/rpc/svc_auth.c
+++ b/src/lib/rpc/svc_auth.c
@@ -39,6 +39,8 @@
#include <gssrpc/rpc.h>
+extern struct svc_auth_ops svc_auth_gss_ops;
+
/*
* Server side authenticators are called from authenticate by
* using the client auth struct flavor field to index into svcauthsw.
@@ -93,6 +95,16 @@ gssrpc__authenticate(
rqst->rq_xprt->xp_verf.oa_length = 0;
cred_flavor = rqst->rq_cred.oa_flavor;
*no_dispatch = FALSE;
+
+ /* xp_auth is currently retained across calls for RPCSEC_GSS. If the
+ * client switched to a different auth flavor, destroy it. */
+ if (rqst->rq_xprt->xp_auth != NULL &&
+ rqst->rq_xprt->xp_auth->svc_ah_ops == &svc_auth_gss_ops &&
+ cred_flavor != RPCSEC_GSS) {
+ SVCAUTH_DESTROY(rqst->rq_xprt->xp_auth);
+ rqst->rq_xprt->xp_auth = NULL;
+ }
+
for (i = 0; i < svcauthnum; i++) {
if (cred_flavor == svcauthsw[i].flavor &&
svcauthsw[i].authenticator != NULL) {
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
