[17215] in Kerberos-V5-bugs
[krbdev.mit.edu #9257] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:01:26 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3129452-1794243677-1108.9257-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9257":;
Date: Mon, 09 Nov 2026 12:01:17 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9257 >
Enforce XDR decode size limits
xdr_array(), xdr_bytes(), and xdr_string() allocate memory based on a
count or length read from the XDR stream. Many callers pass UINT_MAX
as the maxsize parameter, effectively disabling bounds checking. This
allows memory exhaustion in kadmind, and can be leveraged without
authentication via the legacy AUTH_GSSAPI handshake path.
Add three constants in gssrpc/xdr.h:
* GSSRPC_MAX_MESSAGE_SIZE (64 MiB) for the maximum size of a wrapped
RPC message
* GSSRPC_MAX_ELEMENT_SIZE (64 KiB) for individual xdr_bytes and
xdr_string fields
* GSSRPC_MAX_ARRAY_COUNT (8192) for xdr_array element counts
Enforce GSSRPC_MAX_MESSAGE_SIZE in auth_gssapi_misc.c and
authgss_prot.c. Use the other two constants in the kadmin RPC
type functions.
Do not enforce a limit in xdr_gprincs_ret(), which decodes the result
of a list_principals RPC, as the number of principal names returned
could be large.
Do not enforce limits in the iprop protocol. Variable allocations in
iprop are only used when decoding messages from the primary KDC to a
replica KDC.
[ghudson@mit.edu: made style changes; backed out changes to iprop;
edited comments and commit message]
CVE-2026-112319:
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size
limits on XDR-decoded data, which allows remote authenticated users to
cause a denial of service (memory exhaustion or excessive CPU
consumption in kadmind) via crafted RPC requests that trigger
unbounded memory allocations during XDR decoding.
(cherry picked from commit 6946435bc3e66b1cccef0c41105bbd1e7f8c1a92)
https://github.com/krb5/krb5/commit/b6ab8218368c5eaa7a321474fd56c74e1a0280fc
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: b6ab8218368c5eaa7a321474fd56c74e1a0280fc
Branch: krb5-1.22
src/include/gssrpc/xdr.h | 14 +++++++++++
src/lib/kadm5/kadm_rpc_xdr.c | 54 +++++++++++++++++++++++++++---------------
src/lib/kadm5/srv/adb_xdr.c | 9 +++----
src/lib/rpc/auth_gssapi_misc.c | 14 ++++-------
src/lib/rpc/authgss_prot.c | 19 ++++++++++-----
src/lib/rpc/xdr.c | 2 +-
6 files changed, 72 insertions(+), 40 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
