[39466] in Kerberos
Re: Inquiry Regarding CVE-2024-26461 Fix in Upcoming krb5 Release
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Nov 8 12:20:23 2024
Message-ID: <d132d3b5-b2b9-4cdf-9b20-5fe2b622b726@mit.edu>
Date: Fri, 8 Nov 2024 12:18:51 -0500
MIME-Version: 1.0
To: "Zhang, Shawn" <Shawn.Zhang@Dell.com>,
"kerberos@mit.edu"
<kerberos@mit.edu>
Content-Language: en-US
From: "Greg Hudson" <ghudson@mit.edu>
In-Reply-To: <LV2PR19MB586171D088976ABB6F02B584835D2@LV2PR19MB5861.namprd19.prod.outlook.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: kerberos-bounces@mit.edu
On 11/8/24 01:43, Zhang, Shawn via Kerberos wrote:
> I can see that commit c5f9c816107f70139de11b38aa02db2f1774ee0d <https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d> includes the fix for CVE NVD - CVE-2024-26461<https://nvd.nist.gov/vuln/detail/CVE-2024-26461>. However, these changes are not yet included in the latest krb5 release, which is 1.21.3 (krb5-1.21.3-final <https://github.com/krb5/krb5/tree/krb5-1.21.3-final> ).
In my view as the upstream maintainer, these logic errors have zero
impact and should not have been assigned any CVEs. Therefore I have no
intent to backport the fixes to a stable release branch. This CVE is
part of an unfortunate trend where researchers discover "defects" using
static analysis tools and allocate CVEs with no meaningful analysis of
whether there is an actual vulnerability [1].
The logic error in gss_krb5int_make_seal_token_v3() could only result in
a memory leak if the bounds check "SIZE_MAX - 300 < message->length"
triggers, meaning the application asked to wrap or MIC a message of
almost the entire addressable memory. This is of course impossible;
more than 300 bytes of address space will be used by other parts of a
program.
The other logic error is in xdr_rmtcallres(), which I believe (with high
confidence) is unused in this implementation of the RPC library.
[1] https://daniel.haxx.se/blog/2023/09/05/bogus-cve-follow-ups/
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
