[17214] in Kerberos-V5-bugs
[krbdev.mit.edu #9234] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:01:09 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3129065-1794243658-813.9234-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9234":;
Date: Mon, 09 Nov 2026 12:00:58 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9234 >
Prevent read overruns in GSSRPC svcauth_unix
In gssrpc__svcauth_unix(), msg->rm_call.cb_cred.oa_length is only
validated after msg->rm_call.cb_cred.oa_base is parsed, admitting read
overruns if the message is undersized. Replace the retrospective
validation with checks before parsing and after each interior length
is read. Reported by Cem Onat Karagun.
(cherry picked from commit 964fca13050673c620b3ec0b6fb77af1257eacd5)
https://github.com/krb5/krb5/commit/aca0f70145be03d9eb6acf47be8dece3005846b1
Author: Greg Hudson <ghudson@mit.edu>
Commit: aca0f70145be03d9eb6acf47be8dece3005846b1
Branch: krb5-1.22
src/lib/rpc/svc_auth_unix.c | 18 +++++-------------
1 file changed, 5 insertions(+), 13 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
