[17243] in Kerberos-V5-bugs
[krbdev.mit.edu #9256] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:03:32 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3129681-1794243686-833.9256-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9256":;
Date: Mon, 09 Nov 2026 12:01:26 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9256 >
Fix leaks when decoding GSS buffers in libgssrpc
In xdr_rpc_gss_unwrap_data(), if xdr_rpc_gss_buf() fails, free the
value we tried to decode as it may contain partial results. Also
avoid using gss_release_buffer() on buffers not allocated by GSS APIs.
In gssrpc__svcauth_gss(), avoid leaking partial results if
xdr_rpc_gss_cred() fails.
[ghudson@mit.edu: folded in gss_release_buffer->xdr_free fixes; moved
responsibility to callers of XDR decoders; rewrote commit message]
CVE-2026-112315:
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in
MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded
buffers on failure, which allows remote attackers to cause a denial of
service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
(cherry picked from commit cc82b42ce92e2d11be09f69e40795c3c061dd990)
https://github.com/krb5/krb5/commit/2a5a57fed898a59c415d06f95fc1187ef9b977e3
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 2a5a57fed898a59c415d06f95fc1187ef9b977e3
Branch: krb5-1.22
src/lib/rpc/authgss_prot.c | 12 +++++++++---
src/lib/rpc/svc_auth_gss.c | 6 +++---
2 files changed, 12 insertions(+), 6 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
