[17181] in Kerberos-V5-bugs
[krbdev.mit.edu #9260] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:57:17 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3124658-1794243432-1995.9260-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9260":;
Date: Mon, 09 Nov 2026 11:57:12 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:57:12 2026: Request 9260 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9260 >
Disable GSSRPC AUTH_GSSAPI flavor by default
The AUTH_GSSAPI authentication flavor has been superseded by
RPCSEC_GSS since release 1.4. It lacks protections against
unauthenticated resource exhaustion, making it inherently
vulnerable to denial of service attacks.
Disable AUTH_GSSAPI by default in the server-side handler by
returning AUTH_REJECTEDCRED unless the GSSRPC_ALLOW_AUTH_GSSAPI
environment variable is set.
[ghudson@mit.edu: added k5-platform.h include; edited commit message]
CVE-2026-112323:
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5
(aka krb5) 1.5.2 and later allows remote attackers to cause a denial
of service (memory exhaustion in kadmind) by sending repeated failed
AUTH_GSSAPI_INIT requests. Each failed request allocates client state
that is only freed after a 15-minute expiration timeout, allowing an
attacker to accumulate memory faster than it is reclaimed.
CVE-2026-112322:
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka
krb5) restarts its scan from the head of the client list after each
removal, resulting in quadratic CPU cost. Remote attackers can cause
a denial of service (CPU consumption in kadmind) by accumulating a
large number of AUTH_GSSAPI client entries.
https://github.com/krb5/krb5/commit/8aab893c6eb17125e1518f9926bc3593cf19303c
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 8aab893c6eb17125e1518f9926bc3593cf19303c
Branch: master
src/lib/rpc/deps | 7 ++++---
src/lib/rpc/svc_auth_gssapi.c | 9 +++++++++
src/lib/rpc/unit-test/t_rpc.py | 1 +
3 files changed, 14 insertions(+), 3 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
