[17235] in Kerberos-V5-bugs
[krbdev.mit.edu #9238] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:02:45 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3131400-1794243761-626.9238-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9238":;
Date: Mon, 09 Nov 2026 12:02:41 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9238 >
Prevent null deref in KDC dispatch corner case
If a KDC request matches an entry in the lookaside cache, we transmit
the reply without decoding the request, and therefore without looking
up the applicable realm. But if the cached reply is longer than
kdc_max_dgram_reply_size, we need the applicable realm's TGS server
principal to construct a KRB_ERR_RESPONSE_TOO_BIG KRB-ERROR message.
Currently this results in a null derefernce. This case is unlikely to
happen with the default kdc_max_dgram_reply_size value of 65536, but
may be triggerable by an unauthenticated attacker if the value is
lowered. Prevent a null dereference in this scenario by setting an
initial guess at the realm before checking the lookaside cache.
Reported by AWS Security.
(cherry picked from commit 47d220edc71c8229e5fd7a36f3231273c8f06595)
https://github.com/krb5/krb5/commit/e86ffb1de73ede86e48add92786dbdc08bb1b850
Author: Greg Hudson <ghudson@mit.edu>
Commit: e86ffb1de73ede86e48add92786dbdc08bb1b850
Branch: krb5-1.22
src/kdc/dispatch.c | 4 ++++
1 file changed, 4 insertions(+)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
