[17213] in Kerberos-V5-bugs
[krbdev.mit.edu #9260] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:01:06 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3129162-1794243663-107.9260-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9260":;
Date: Mon, 09 Nov 2026 12:01:03 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9260 >
Disable GSSRPC AUTH_GSSAPI flavor by default
The AUTH_GSSAPI authentication flavor has been superseded by
RPCSEC_GSS since release 1.4. It lacks protections against
unauthenticated resource exhaustion, making it inherently
vulnerable to denial of service attacks.
Disable AUTH_GSSAPI by default in the server-side handler by
returning AUTH_REJECTEDCRED unless the GSSRPC_ALLOW_AUTH_GSSAPI
environment variable is set.
[ghudson@mit.edu: added k5-platform.h include; edited commit message]
CVE-2026-112323:
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5
(aka krb5) 1.5.2 and later allows remote attackers to cause a denial
of service (memory exhaustion in kadmind) by sending repeated failed
AUTH_GSSAPI_INIT requests. Each failed request allocates client state
that is only freed after a 15-minute expiration timeout, allowing an
attacker to accumulate memory faster than it is reclaimed.
CVE-2026-112322:
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka
krb5) restarts its scan from the head of the client list after each
removal, resulting in quadratic CPU cost. Remote attackers can cause
a denial of service (CPU consumption in kadmind) by accumulating a
large number of AUTH_GSSAPI client entries.
(cherry picked from commit 8aab893c6eb17125e1518f9926bc3593cf19303c)
https://github.com/krb5/krb5/commit/ff55721f142b914ea9ccb02dabae2d679f0eff1a
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: ff55721f142b914ea9ccb02dabae2d679f0eff1a
Branch: krb5-1.22
src/lib/rpc/deps | 7 ++++---
src/lib/rpc/svc_auth_gssapi.c | 9 +++++++++
src/lib/rpc/unit-test/t_rpc.py | 1 +
3 files changed, 14 insertions(+), 3 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
