[17203] in Kerberos-V5-bugs
[krbdev.mit.edu #9238] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:59:40 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3127286-1794243574-808.9238-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9238":;
Date: Mon, 09 Nov 2026 11:59:34 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:59:34 2026: Request 9238 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9238 >
Prevent null deref in KDC dispatch corner case
If a KDC request matches an entry in the lookaside cache, we transmit
the reply without decoding the request, and therefore without looking
up the applicable realm. But if the cached reply is longer than
kdc_max_dgram_reply_size, we need the applicable realm's TGS server
principal to construct a KRB_ERR_RESPONSE_TOO_BIG KRB-ERROR message.
Currently this results in a null derefernce. This case is unlikely to
happen with the default kdc_max_dgram_reply_size value of 65536, but
may be triggerable by an unauthenticated attacker if the value is
lowered. Prevent a null dereference in this scenario by setting an
initial guess at the realm before checking the lookaside cache.
Reported by AWS Security.
https://github.com/krb5/krb5/commit/47d220edc71c8229e5fd7a36f3231273c8f06595
Author: Greg Hudson <ghudson@mit.edu>
Commit: 47d220edc71c8229e5fd7a36f3231273c8f06595
Branch: master
src/kdc/dispatch.c | 4 ++++
1 file changed, 4 insertions(+)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
