[17178] in Kerberos-V5-bugs
[krbdev.mit.edu #9229] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:57:04 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3124349-1794243418-1232.9229-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9229":;
Date: Mon, 09 Nov 2026 11:56:58 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:56:58 2026: Request 9229 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9229 >
Exclude nested AD-IF-RELEVANT authdata in KDC
When including authdata from a KDC request, the KDC tries to filter
out authdata types that should only originate from KDCs using
is_kdc_issued_authdata(). This check is not strictly necessary for
authdata security and is not a sufficient mechanism for authdata
security by itself (because new KDC-origin-only authdata types can be
added over time), but it can mitigate the impact of some bugs.
When the authdata type is AD-IF-RELEVANT, is_kdc_issued_authdata()
performs minimal decoding on the container, extracting only the
authdata types. This is good because it limits the amount of KDC time
and memory a client can consume by requesting an authdata element
packed with nested containers. But it also means we miss KDC-issued
authdata elements within nested AD-IF-RELEVANT containers; such
elements would be found by krb5_find_authdata() so are still operable.
In is_kdc_issued_authdata(), assume that any client-provided authdata
element containing a nested AD-IF-RELEVANT container is nefarious and
filter it out. Also remove the desired_type parameter as we no longer
need it.
Discovered by Claude and Ada Logics, and by Alejandro Pacheco. Test
case adapted from a patch by Alejandro Pacheco.
https://github.com/krb5/krb5/commit/e81ea7f9a9c2e04faf5d24452f96a0419a047aac
Author: Greg Hudson <ghudson@mit.edu>
Commit: e81ea7f9a9c2e04faf5d24452f96a0419a047aac
Branch: master
src/kdc/kdc_authdata.c | 14 +++++++++-----
src/tests/t_authdata.py | 8 ++++++++
2 files changed, 17 insertions(+), 5 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
