CVE-2026-112315: Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Pre-auth Memory Leak in RPCSECGSS Credential Decode Failure Path (gssrpcsvcauthgss): malformed unauthenticated RPCSECGSS credentials can leak gcctx allocations on decode failure, allowing gradual memory-exhaustion denial of service. Requirements to exploit: Network reachability to a service from krb5-1.21.3-8.el100 that parses RPCSECGSS credentials before authentication, plus the ability to send repeated malformed RPC requests with a truncated embedded gcctx buffer. No prior authentication or user interaction is required. Component affected: krb5-1.21.3-8.el100, src/lib/rpc/svcauthgss.c, gssrpcsvcauthgss (with the leaking allocation originating from xdrrpcgsscred() via xdrrpcgssbuf() / xdrbytes()) Version affected: krb5-1.21.3-8.el100 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - 5.3 (MEDIUM) AV:N - The affected code parses attacker-controlled RPC credential data over the network. AC:L - The failure condition is induced with a malformed but simple truncated credential blob. PR:N - The leak occurs in the pre-authentication credential decode path. UI:N - No user interaction is required. S:U - The impact is limited to the targeted service process. C:N - The available evidence does not show unauthorized data disclosure. I:N - The available evidence does not show data modification or code execution. A:L - Each request leaks only a bounded amount of memory (MAXAUTHBYTES), but repeated requests can accumulate enough loss to degrade or eventually exhaust the service. Impact: Important. Red Hat classifies flaws that allow remote users to cause denial of service as Important, and this issue is reachable before authentication where an exposed RPCSECGSS service path exists. The practical effect established here is gradual availability loss rather than immediate crash or system compromise, because the leak is bounded per request and requires repetition. Embargo: no Reason: The demonstrated impact is availability-only, the leak is gradual, and straightforward mitigations exist by restricting network access to affected RPCSECGSS-enabled administrative services while a fix is prepared. Acknowledgement: Aisle Research Vulnerability Details: In gssrpcsvcauthgss(), a decode failure returns immediately instead of using the existing freegc: cleanup path: c if (!xdrrpcgsscred(&xdrs, gc)) { logdebug("xdrrpcgsscred() failed"); XDRDESTROY(&xdrs); return (AUTHBADCRED); } ... freegc: xdrfree((xdrproct)xdrrpcgsscred, gc); logdebug("returning %d from svcauthgss()", retstat); return (retstat); The decoded gcctx field is populated through xdrrpcgssbuf() and xdrbytes(). On XDRDECODE, xdrbytes() allocates the buffer before it attempts to read the declared opaque bytes. If the embedded RPCSECGSS credential advertises a non-zero gcctx length but truncates the remaining credential bytes, the opaque read can fail after allocation. Because the function returns before xdrfree((xdrproct)xdrrpcgsscred, gc) is reached, that nested allocation is not released on the failing request. The available material further supports that this parser is selected from the server authentication dispatch when cbcred.oaflavor is RPCSECGSS. The resulting leak is bounded per request by the credential-size checks, but repeated malformed unauthenticated requests can cause monotonic memory growth over time. The evidence supports this for deployments that expose an RPCSECGSS-enabled service path, including in-tree administrative paths such as kadmind or iprop; it does not establish that every deployment of the SRPM exposes those paths. Steps to reproduce: 1. Reach a server path built from krb5-1.21.3-8.el100 that accepts RPCSECGSS credentials before authentication. 2. Send an RPC call with cbcred.oaflavor = RPCSECGSS. 3. Keep the outer credential blob within the accepted MAXAUTHBYTES limit so decoding proceeds into the embedded RPCSECGSS credential. 4. Inside the embedded credential, set gcctx to a non-zero declared length but truncate the remaining bytes so allocation occurs and the subsequent opaque-byte read fails. 5. Observe an authentication failure associated with AUTHBADCRED while the service retains the allocation from the failed decode path. 6. Repeat the malformed request and monitor service memory growth over time. Mitigation: Restrict network access to RPCSECGSS-enabled administrative services to trusted clients until a fix is available. Where feasible, do not expose kadmind/iprop-related RPC endpoints to untrusted networks, and apply rate limiting or connection controls to reduce the effect of repeated malformed requests. Proposed Fix: Route the decode-failure path through the existing freegc: cleanup so partially decoded RPCSECGSS credentials are always released. diff diff --git a/krb5-1.21.3/src/lib/rpc/svcauthgss.c b/krb5-1.21.3/src/lib/rpc/svcauthgss.c index <old>..<new> 100644 — a/krb5-1.21.3/src/lib/rpc/svcauthgss.c +++ b/krb5-1.21.3/src/lib/rpc/svcauthgss.c @@ -434,10 +434,12 @@ gssrpcsvcauthgss(struct svcreq rqst, struct rpcmsg msg, rqst->rqcred.oalength, XDRDECODE); logdebug("xdrmemcreate() returned"); if (!xdrrpcgsscred(&xdrs, gc)) { logdebug("xdrrpcgsscred() failed"); XDRDESTROY(&xdrs); return (AUTHBADCRED); + retstat = AUTHBADCRED; + goto freegc; } XDRDESTROY(&xdrs);

An equivalent fix is to call xdrfree((xdrproct)xdrrpcgsscred, gc) immediately before returning AUTHBADCRED. ------ This report was generated using AI technology. Always review AI-generated content prior to use