[17170] in Kerberos-V5-bugs
[krbdev.mit.edu #9279] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Tue Nov 3 19:18:39 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-2373075-1793751514-940.9279-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9279":;
Date: Tue, 03 Nov 2026 19:18:34 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9279 >
Fix use-after-free of LDAP handle after rebind
Commit 5d3fe31bf1dc48e8ee946bf65428611958cac329 ("Add alias support"),
moved the LDAP search for a principal into helper functions
search_princ() and search_at(). When a search fails because the LDAP
connection has gone away, the LDAP_SEARCH macro calls
krb5_ldap_rebind(), which changes the handle. It either replaces the
handle's LDAP connection and frees the old one, or, if the server
cannot be reached, calls krb5_ldap_request_next_handle_from_pool(),
which frees every pooled handle for that server (including the
caller's) and substitutes the handle of another server or NULL. When
the search happens in one of the new helper functions, LDAP_SEARCH
only updates the local variables of the helper, leaving the caller
with stale pointers. This commit first appeared in release 1.22.
check_dn_exists() and validate_xargs() have the same flaw, which
predates 1.22, but they are only used by kadmin operations.
Pass the server handle by reference to search_at(), search_princ(),
check_dn_exists(), validate_xargs(), and add_alias(). In the callers,
reset LDAP pointer from the handle after each call.
Co-authored by Copilot App.
[ghudson@mit.edu: edited commit message]
(cherry picked from commit ea21d47ed4eedb530c76a5a4a7e69a6ed3a26770)
https://github.com/krb5/krb5/commit/5ce420ec0e0df42767fb15adfaae97bc9a2115fc
Author: Alex Moore <98565783+lightspd10@users.noreply.github.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 5ce420ec0e0df42767fb15adfaae97bc9a2115fc
Branch: krb5-1.22
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 56 +++++++++++++++-------
1 file changed, 38 insertions(+), 18 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
