[17212] in Kerberos-V5-bugs
[krbdev.mit.edu #9229] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:01:01 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3128868-1794243649-1367.9229-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9229":;
Date: Mon, 09 Nov 2026 12:00:50 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9229 >
Exclude nested AD-IF-RELEVANT authdata in KDC
When including authdata from a KDC request, the KDC tries to filter
out authdata types that should only originate from KDCs using
is_kdc_issued_authdata(). This check is not strictly necessary for
authdata security and is not a sufficient mechanism for authdata
security by itself (because new KDC-origin-only authdata types can be
added over time), but it can mitigate the impact of some bugs.
When the authdata type is AD-IF-RELEVANT, is_kdc_issued_authdata()
performs minimal decoding on the container, extracting only the
authdata types. This is good because it limits the amount of KDC time
and memory a client can consume by requesting an authdata element
packed with nested containers. But it also means we miss KDC-issued
authdata elements within nested AD-IF-RELEVANT containers; such
elements would be found by krb5_find_authdata() so are still operable.
In is_kdc_issued_authdata(), assume that any client-provided authdata
element containing a nested AD-IF-RELEVANT container is nefarious and
filter it out. Also remove the desired_type parameter as we no longer
need it.
Discovered by Claude and Ada Logics, and by Alejandro Pacheco. Test
case adapted from a patch by Alejandro Pacheco.
(cherry picked from commit e81ea7f9a9c2e04faf5d24452f96a0419a047aac)
https://github.com/krb5/krb5/commit/8137e349a9c1710de36246d27f5db95ddcd128d2
Author: Greg Hudson <ghudson@mit.edu>
Commit: 8137e349a9c1710de36246d27f5db95ddcd128d2
Branch: krb5-1.22
src/kdc/kdc_authdata.c | 14 +++++++++-----
src/tests/t_authdata.py | 8 ++++++++
2 files changed, 17 insertions(+), 5 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
