[17184] in Kerberos-V5-bugs
[krbdev.mit.edu #9257] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:57:41 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3125002-1794243453-1419.9257-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9257":;
Date: Mon, 09 Nov 2026 11:57:33 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:57:33 2026: Request 9257 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9257 >
Enforce XDR decode size limits
xdr_array(), xdr_bytes(), and xdr_string() allocate memory based on a
count or length read from the XDR stream. Many callers pass UINT_MAX
as the maxsize parameter, effectively disabling bounds checking. This
allows memory exhaustion in kadmind, and can be leveraged without
authentication via the legacy AUTH_GSSAPI handshake path.
Add three constants in gssrpc/xdr.h:
* GSSRPC_MAX_MESSAGE_SIZE (64 MiB) for the maximum size of a wrapped
RPC message
* GSSRPC_MAX_ELEMENT_SIZE (64 KiB) for individual xdr_bytes and
xdr_string fields
* GSSRPC_MAX_ARRAY_COUNT (8192) for xdr_array element counts
Enforce GSSRPC_MAX_MESSAGE_SIZE in auth_gssapi_misc.c and
authgss_prot.c. Use the other two constants in the kadmin RPC
type functions.
Do not enforce a limit in xdr_gprincs_ret(), which decodes the result
of a list_principals RPC, as the number of principal names returned
could be large.
Do not enforce limits in the iprop protocol. Variable allocations in
iprop are only used when decoding messages from the primary KDC to a
replica KDC.
[ghudson@mit.edu: made style changes; backed out changes to iprop;
edited comments and commit message]
CVE-2026-112319:
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size
limits on XDR-decoded data, which allows remote authenticated users to
cause a denial of service (memory exhaustion or excessive CPU
consumption in kadmind) via crafted RPC requests that trigger
unbounded memory allocations during XDR decoding.
https://github.com/krb5/krb5/commit/6946435bc3e66b1cccef0c41105bbd1e7f8c1a92
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 6946435bc3e66b1cccef0c41105bbd1e7f8c1a92
Branch: master
src/include/gssrpc/xdr.h | 14 +++++++++++
src/lib/kadm5/kadm_rpc_xdr.c | 54 +++++++++++++++++++++++++++---------------
src/lib/kadm5/srv/adb_xdr.c | 9 +++----
src/lib/rpc/auth_gssapi_misc.c | 14 ++++-------
src/lib/rpc/authgss_prot.c | 19 ++++++++++-----
src/lib/rpc/xdr.c | 2 +-
6 files changed, 72 insertions(+), 40 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
