[31692] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Disable GSSRPC AUTH_GSSAPI flavor by default
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:05:06 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170059.14916105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:00:59 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/ff55721f142b914ea9ccb02dabae2d679f0eff1a
commit ff55721f142b914ea9ccb02dabae2d679f0eff1a
Author: Julien Rische <jrische@redhat.com>
Date: Thu Oct 15 20:37:46 2026 +0200
Disable GSSRPC AUTH_GSSAPI flavor by default
The AUTH_GSSAPI authentication flavor has been superseded by
RPCSEC_GSS since release 1.4. It lacks protections against
unauthenticated resource exhaustion, making it inherently
vulnerable to denial of service attacks.
Disable AUTH_GSSAPI by default in the server-side handler by
returning AUTH_REJECTEDCRED unless the GSSRPC_ALLOW_AUTH_GSSAPI
environment variable is set.
[ghudson@mit.edu: added k5-platform.h include; edited commit message]
CVE-2026-112323:
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5
(aka krb5) 1.5.2 and later allows remote attackers to cause a denial
of service (memory exhaustion in kadmind) by sending repeated failed
AUTH_GSSAPI_INIT requests. Each failed request allocates client state
that is only freed after a 15-minute expiration timeout, allowing an
attacker to accumulate memory faster than it is reclaimed.
CVE-2026-112322:
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka
krb5) restarts its scan from the head of the client list after each
removal, resulting in quadratic CPU cost. Remote attackers can cause
a denial of service (CPU consumption in kadmind) by accumulating a
large number of AUTH_GSSAPI client entries.
(cherry picked from commit 8aab893c6eb17125e1518f9926bc3593cf19303c)
ticket: 9260
version_fixed: 1.22.3
src/lib/rpc/deps | 7 ++++---
src/lib/rpc/svc_auth_gssapi.c | 9 +++++++++
src/lib/rpc/unit-test/t_rpc.py | 1 +
3 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/src/lib/rpc/deps b/src/lib/rpc/deps
index f57b831d9..1248c4cbc 100644
--- a/src/lib/rpc/deps
+++ b/src/lib/rpc/deps
@@ -249,14 +249,15 @@ svc_auth_unix.so svc_auth_unix.po $(OUTPRE)svc_auth_unix.$(OBJEXT): \
$(top_srcdir)/include/gssrpc/svc_auth.h $(top_srcdir)/include/gssrpc/xdr.h \
svc_auth_unix.c
svc_auth_gssapi.so svc_auth_gssapi.po $(OUTPRE)svc_auth_gssapi.$(OBJEXT): \
- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/krb5/krb5.h \
- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
+ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
+ $(BUILDTOP)/include/gssapi/gssapi_generic.h $(BUILDTOP)/include/gssrpc/types.h \
+ $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
$(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_gssapi.h \
$(top_srcdir)/include/gssrpc/auth_unix.h $(top_srcdir)/include/gssrpc/clnt.h \
$(top_srcdir)/include/gssrpc/rename.h $(top_srcdir)/include/gssrpc/rpc.h \
$(top_srcdir)/include/gssrpc/rpc_msg.h $(top_srcdir)/include/gssrpc/svc.h \
$(top_srcdir)/include/gssrpc/svc_auth.h $(top_srcdir)/include/gssrpc/xdr.h \
+ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \
$(top_srcdir)/include/krb5.h gssrpcint.h svc_auth_gssapi.c
svc_raw.so svc_raw.po $(OUTPRE)svc_raw.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
$(BUILDTOP)/include/gssrpc/types.h $(top_srcdir)/include/gssrpc/auth.h \
diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c
index 4be1e0433..ac4b7a9ac 100644
--- a/src/lib/rpc/svc_auth_gssapi.c
+++ b/src/lib/rpc/svc_auth_gssapi.c
@@ -11,6 +11,7 @@
* side of RPC.
*/
+#include "k5-platform.h"
#include <stdio.h>
#include <errno.h>
#include <string.h>
@@ -173,6 +174,14 @@ enum auth_stat gssrpc__svcauth_gssapi(
OM_uint32 ret_flags;
uint32_t seq_num;
+ /*
+ * AUTH_GSSAPI is vulnerable to denial-of-service attacks. It is disabled
+ * by default, but can be re-enabled by setting the
+ * GSSRPC_ALLOW_AUTH_GSSAPI environment variable.
+ */
+ if (secure_getenv("GSSRPC_ALLOW_AUTH_GSSAPI") == NULL)
+ return AUTH_REJECTEDCRED;
+
PRINTF(("svcauth_gssapi: starting\n"));
/* clean up expired entries */
diff --git a/src/lib/rpc/unit-test/t_rpc.py b/src/lib/rpc/unit-test/t_rpc.py
index 4e565d25c..5ab5d32df 100644
--- a/src/lib/rpc/unit-test/t_rpc.py
+++ b/src/lib/rpc/unit-test/t_rpc.py
@@ -3,6 +3,7 @@ import re
from k5test import *
realm = K5Realm()
+realm.env['GSSRPC_ALLOW_AUTH_GSSAPI'] = 'yes'
server = realm.start_server(['./server', '-t'], 'running')
line = server.stdout.readline()
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
