CVE-2026-112316: Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Authenticated DoS via Memory Leak in xdrkrb5tldata Decode Error Path: malformed authenticated kadmind RPC requests with non-null tldata can leak heap allocations on decode failure and eventually exhaust process memory. Requirements to exploit: Network reachability to kadmind, valid credentials for a principal able to establish an authenticated RPCSECGSS session to the kadmin RPC service, and the ability to send a malformed request that decodes kadm5principalentrec with non-null tldata. Component affected: krb5-1.21.3-8.el100, src/lib/kadm5/kadmrpcxdr.c, xdrkrb5tldata() in the kadmind request decode path for kadm5principalentrec.tldata. Version affected: krb5-1.21.3-8.el100 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:N - The vulnerable path is reachable over the network through the kadmind RPC service. AC:L - Exploitation only requires sending malformed tldata that fails decoding after allocation. PR:L - A valid authenticated RPCSECGSS session to kadmind is required; the leak occurs during request decoding rather than after successful completion of the requested administrative operation. UI:N - No user interaction is required once the attacker can send requests. S:U - The impact is confined to the kadmind service boundary. C:N - No confidentiality impact is established by the available evidence. I:N - No integrity impact is established by the available evidence. A:H - Repeated requests can drive unbounded memory growth and deny availability of the long-lived kadmind process. Impact: Important. Red Hat classifies remote denial of service issues as Important when they can readily compromise service availability. This issue allows an authenticated remote user to repeatedly exhaust memory in kadmind through a normal request decode path once a valid session exists. Critical is not appropriate because authentication is required and no code execution, privilege escalation, or broader system compromise is established. Embargo: no Reason: The issue is limited to authenticated availability impact against an administrative service, and operators can reduce exposure by restricting access to kadmind until a fix is available. Acknowledgement: Aisle Research Vulnerability Details: In xdrkrb5tldata(), the XDRDECODE path allocates a new krb5tldata element and decodes its fields before the accumulated list is linked into tldatahead. The affected block is: c case XDRDECODE: tl = NULL; while (1) { if (!xdrbool(xdrs, &more)) return FALSE; if (more == FALSE) break; tl2 = (krb5tldata ) malloc(sizeof(krb5tldata)); if (tl2 == NULL) return FALSE; memset(tl2, 0, sizeof(krb5tldata)); if (!xdrkrb5int16(xdrs, &tl2->tldatatype)) return FALSE; if (!xdrbytes(xdrs, (char )&tl2->tldatacontents, &len, ~0)) return FALSE; tl2->tldatalength = len; tl2->tldatanext = tl; tl = tl2; } tldatahead = tl; break; If xdrbool, xdrkrb5int16, or xdrbytes fails after allocation, the function returns FALSE immediately. At that point, the current tl2 allocation, any tl2->tldatacontents buffer allocated by xdrbytes, and any previously built tl chain are not attached to tldatahead. In the kadmind request path, failed RPC argument decoding is cleaned up through the decoded argument object; because the partially constructed list is never linked into that object, those allocations remain unreachable to normal XDRFREE cleanup and are leaked. The available evidence shows this is reachable with authenticated CREATEPRINCIPAL and MODIFYPRINCIPAL requests that carry non-null rec.tldata. Steps to reproduce: 1. Start kadmind built from krb5-1.21.3-8.el100 with normal RPCSECGSS authentication. 2. Authenticate as any principal able to establish a valid RPCSECGSS session to the kadmin RPC service. 3. Send a CREATEPRINCIPAL or MODIFYPRINCIPAL RPC request containing non-null rec.tldata. 4. In the tldata sequence, set more = TRUE, begin one entry, then truncate or corrupt the stream so decoding fails at xdrkrb5int16 or xdrbytes. 5. Repeat the malformed request and monitor kadmind RSS with ps or /proc/<pid>/status; the process memory grows monotonically across failed decodes. Mitigation: Until a fixed package is available, restrict network access to kadmind to trusted administration hosts, limit which principals can establish authenticated sessions where deployment policy allows, and monitor or restart kadmind if abnormal RSS growth is observed. Disabling kadmind where it is not required removes remote exposure to the vulnerable decode path. Proposed Fix: Route all XDRDECODE failures through a cleanup path that frees the current element and any previously built tldata chain before returning FALSE. diff diff --git a/src/lib/kadm5/kadmrpcxdr.c b/src/lib/kadm5/kadmrpcxdr.c — a/src/lib/kadm5/kadmrpcxdr.c +++ b/src/lib/kadm5/kadmrpcxdr.c @@ -334,27 +334,40 @@ boolt xdrkrb5tldata(XDR xdrs, krb5tldata tldatahead) case XDRDECODE: tl = NULL; + tl = NULL; while (1) { if (!xdrbool(xdrs, &more))

return FALSE; + goto decodefail; if (more == FALSE) break; tl2 = (krb5tldata ) malloc(sizeof(krb5tldata)); if (tl2 == NULL)

return FALSE; + goto decodefail; memset(tl2, 0, sizeof(krb5tldata));

if (!xdrkrb5int16(xdrs, &tl2->tldatatype))

return FALSE;

if (!xdrbytes(xdrs, (char )&tl2->tldatacontents, &len, ~0))

return FALSE; + if (!xdrkrb5int16(xdrs, &tl2->tldatatype)) { + free(tl2); + goto decodefail; + } + if (!xdrbytes(xdrs, (char )&tl2->tldatacontents, &len, ~0)) { + free(tl2->tldatacontents); + free(tl2); + goto decodefail; + } tl2->tldatalength = len;

tl2->tldatanext = tl; tl = tl2; } tldatahead = tl; break; + +decodefail: + while (tl != NULL) { + tl2 = tl->tldatanext; + free(tl->tldatacontents); + free(tl); + tl = tl2; + } + return FALSE; } ------ This report was generated using AI technology. Always review AI-generated content prior to use