[17216] in Kerberos-V5-bugs
[krbdev.mit.edu #9255] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:01:27 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3129585-1794243682-1841.9255-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9255":;
Date: Mon, 09 Nov 2026 12:01:22 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9255 >
Free partial tl-data on XDR decode failure
An XDR decoder may leave allocated memory in the caller's pointer on
failure, but may not entirely leak it. In xdr_krb5_tl_data(), free
the in-progress list and tl-data item on decode failure, as they are
stored in local variables and only assigned to *tl_data_head on
success.
[ghudson@mit.edu: rewrote patch to use goto label and xdr_free();
rewrote commit message]
CVE-2026-112316:
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka
krb5) does not free partially decoded data on failure, which allows
remote authenticated users to cause a denial of service (memory leak
in kadmind) via crafted RPC requests that trigger a decode failure.
(cherry picked from commit fe0a8a67f2fce89bb9d62031219a1f5a064c4df1)
https://github.com/krb5/krb5/commit/bf47c9410127636b7e3d79a8135058ef5991599d
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: bf47c9410127636b7e3d79a8135058ef5991599d
Branch: krb5-1.22
src/lib/kadm5/kadm_rpc_xdr.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
