[17185] in Kerberos-V5-bugs
[krbdev.mit.edu #9255] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:57:46 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3125152-1794243462-740.9255-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9255":;
Date: Mon, 09 Nov 2026 11:57:42 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:57:42 2026: Request 9255 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9255 >
Free partial tl-data on XDR decode failure
An XDR decoder may leave allocated memory in the caller's pointer on
failure, but may not entirely leak it. In xdr_krb5_tl_data(), free
the in-progress list and tl-data item on decode failure, as they are
stored in local variables and only assigned to *tl_data_head on
success.
[ghudson@mit.edu: rewrote patch to use goto label and xdr_free();
rewrote commit message]
CVE-2026-112316:
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka
krb5) does not free partially decoded data on failure, which allows
remote authenticated users to cause a denial of service (memory leak
in kadmind) via crafted RPC requests that trigger a decode failure.
https://github.com/krb5/krb5/commit/fe0a8a67f2fce89bb9d62031219a1f5a064c4df1
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: fe0a8a67f2fce89bb9d62031219a1f5a064c4df1
Branch: master
src/lib/kadm5/kadm_rpc_xdr.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
