[16756] in Kerberos-V5-bugs
[krbdev.mit.edu #9007] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Jul 12 12:41:38 2021
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3423220-1626108091-1159.9007-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9007":;
Date: Mon, 12 Jul 2021 12:41:31 -0400
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9007 >
Fix KDC null deref on bad encrypted challenge
The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check
to avoid further processing if the armor key is NULL. However, this
check is bypassed by a call to k5memdup0() which overwrites retval
with 0 if the allocation succeeds. If the armor key is NULL, a call
to krb5_c_fx_cf2_simple() will then dereference it, resulting in a
crash. Add a check before the k5memdup0() call to avoid overwriting
retval.
CVE-2021-36222:
In MIT krb5 releases 1.16 and later, an unauthenticated attacker can
cause a null dereference in the KDC by sending a request containing a
PA-ENCRYPTED-CHALLENGE padata element without using FAST.
[ghudson@mit.edu: trimmed patch; added test case; edited commit
message]
(cherry picked from commit fc98f520caefff2e5ee9a0026fdf5109944b3562)
https://github.com/krb5/krb5/commit/c4a406095b3ea4a67ae5b8ea586cbe9abdbae76f
Author: Joseph Sutton <josephsutton@catalyst.net.nz>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: c4a406095b3ea4a67ae5b8ea586cbe9abdbae76f
Branch: krb5-1.18
src/kdc/kdc_preauth_ec.c | 3 +-
src/tests/Makefile.in | 1 +
src/tests/t_cve-2021-36222.py | 46 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 49 insertions(+), 1 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
