CVE-2026-112319: Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Authenticated Memory Exhaustion and Leak in RPCSECGSS Unwrapping (xdrrpcgssunwrapdata): authenticated RPCSECGSS DATA requests can supply oversized XDR lengths that trigger large pre-verification allocations and leave some decode-failure allocations unreleased, enabling repeatable memory exhaustion and denial of service. Requirements to exploit: A remote attacker needs network reachability to a deployed service using this SRPM's GSSRPC unwrap path, a valid RPCSECGSS security context accepted by that service, and the ability to send oversized or truncated wrapped RPC arguments. Component affected: krb5 library code in src/lib/rpc/authgssprot.c:xdrrpcgssunwrapdata via xdrrpcgssbuf, with the allocation behavior in src/lib/rpc/xdr.c:xdrbytes Version affected: krb5-1.21.3-8.el100 when deployed with a service that accepts authenticated RPCSECGSSDATA requests through the GSSRPC unwrap path Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:N - The issue is reachable over the network against a service exposing the RPCSECGSS unwrap path. AC:L - Once authenticated, the attack is straightforward: send oversized XDR lengths and a malformed or incomplete wrapped body. PR:L - A valid RPCSECGSS context is required. UI:N - No user interaction is needed. S:U - The impact is confined to the targeted service process. C:N - No confidentiality impact is established by the available evidence. I:N - No integrity impact is established by the available evidence. A:H - Large allocations plus unreleased buffers on some decode failures can exhaust memory and deny service. Impact: Important. Where this RPCSECGSS path is exposed, an authenticated remote client can directly compromise availability by forcing repeated high-memory allocations and leak-driven growth in the service process. This aligns with Red Hat's Important category for remote denial of service; the authentication requirement and lack of demonstrated confidentiality or integrity impact keep it below Critical. Embargo: no Reason: The issue requires valid RPCSECGSS credentials and exposure of a vulnerable RPCSECGSS service, and the demonstrated impact is denial of service rather than code execution or privilege escalation. Acknowledgement: Aisle Research Vulnerability Details: xdrrpcgssunwrapdata decodes attacker-controlled wrapped buffers with maxsize = (unsigned int)-1 for both integrity and privacy services. That value is then passed into xdrbytes, which allocates memory directly from the wire length before MIC verification or unwrap validation completes. c if (svc == RPCSECGSSSVCINTEGRITY) { / Decode databodyinteg. / if (!xdrrpcgssbuf(xdrs, &databuf, (unsigned int)-1)) { logdebug("xdr decode databodyinteg failed"); return (FALSE); } / Decode checksum. / if (!xdrrpcgssbuf(xdrs, &wrapbuf, (unsigned int)-1)) { gssreleasebuffer(&minstat, &databuf); logdebug("xdr decode checksum failed"); return (FALSE); } / Verify checksum and QOP. / majstat = gssverifymic(&minstat, ctx, &databuf, &wrapbuf, &qopstate); free(wrapbuf.value); if (majstat != GSSSCOMPLETE || qopstate != qop) { gssreleasebuffer(&minstat, &databuf); logstatus("gssverifymic", majstat, minstat); return (FALSE); } } else if (svc == RPCSECGSSSVCPRIVACY) { / Decode databodypriv. / if (!xdrrpcgssbuf(xdrs, &wrapbuf, (unsigned int)-1)) { logdebug("xdr decode databodypriv failed"); return (FALSE); } c if (! xdruint(xdrs, sizep)) { return (FALSE); } nodesize = sizep; if ((nodesize > maxsize) && (xdrs->xop != XDRFREE)) { return (FALSE); } / now deal with the actual bytes / switch (xdrs->xop) {

case XDRDECODE: if (nodesize == 0) { return (TRUE); } if (sp == NULL) { cpp = sp = (char )memalloc(nodesize); } Because maxsize is effectively UINTMAX in this call path, the nodesize > maxsize check does not provide a practical bound. The allocation happens before gssverifymic() or gssunwrap(), and some decode-error exits return FALSE without releasing every buffer that may already have been allocated. Repeated malformed or incomplete authenticated requests can therefore grow process RSS over time and deny service. The available evidence supports an availability issue; no direct confidentiality or integrity impact was established. Steps to reproduce: 1. Start a service using this GSSRPC code path with RPCSECGSS enabled over TCP, for example an administration service using the GSSRPC server path. 2. Establish a valid RPCSECGSS context as an authenticated client. 3. Send an RPCSECGSSDATA request with gcproc = RPCSECGSSDATA and gcsvc = RPCSECGSSSVCINTEGRITY or RPCSECGSSSVCPRIVACY. 4. Set the wrapped databuf or wrapbuf XDR length prefix to a large value, such as 64 MB or larger. 5. Trigger decode failure after allocation by sending a malformed or incomplete wrapped body and closing the connection, then repeat the request. 6. Observe process RSS increasing over time, followed by service degradation or denial of service. Mitigation: Until a code fix is available, restrict network exposure of services that use this RPCSECGSS unwrap path to trusted authenticated principals and apply conservative service memory limits where possible. Existing connection-count controls can reduce concurrent amplification, but they do not prevent serial memory growth because allocation occurs before MIC or unwrap verification. Proposed Fix: A minimal patch is below. It introduces a bounded unwrap size and adds cleanup in decode-failure branches that can leave wrapbuf allocated. The bound can also be made configurable or tied to transport policy. diff diff --git a/src/lib/rpc/authgssprot.c b/src/lib/rpc/authgssprot.c — a/src/lib/rpc/authgssprot.c +++ b/src/lib/rpc/authgssprot.c @@ -46,6 +46,9 @@ #include <gssapi/gssapi.h> #endif +/ Upper bound for decoded wrapped RPCSECGSS payloads. / +#define RPCSECGSSMAXUNWRAP (16U 1024U 1024U) + boolt xdrrpcgssbuf(XDR xdrs, gssbuffert buf, uint maxsize) { @@ -202,13 +205,18 @@ xdrrpcgssunwrapdata(XDR xdrs, xdrproct xdrfunc, caddrt xdrptr, if (svc == RPCSECGSSSVCINTEGRITY) { / Decode databodyinteg. / - if (!xdrrpcgssbuf(xdrs, &databuf, (unsigned int)-1)) { + if (!xdrrpcgssbuf(xdrs, &databuf, RPCSECGSSMAXUNWRAP)) { logdebug("xdr decode databodyinteg failed"); return (FALSE); } / Decode checksum. / - if (!xdrrpcgssbuf(xdrs, &wrapbuf, (unsigned int)-1)) { + if (!xdrrpcgssbuf(xdrs, &wrapbuf, RPCSECGSSMAXUNWRAP)) { gssreleasebuffer(&minstat, &databuf); + if (wrapbuf.value != NULL) + free(wrapbuf.value); logdebug("xdr decode checksum failed"); return (FALSE); } @@ -225,7 +233,10 @@ xdrrpcgssunwrapdata(XDR xdrs, xdrproct xdrfunc, caddrt xdrptr, } else if (svc == RPCSECGSSSVCPRIVACY) { / Decode databodypriv. / - if (!xdrrpcgssbuf(xdrs, &wrapbuf, (unsigned int)-1)) { + if (!xdrrpcgssbuf(xdrs, &wrapbuf, RPCSECGSSMAXUNWRAP)) { + if (wrapbuf.value != NULL) + free(wrapbuf.value); logdebug("xdr decode databodypriv failed"); return (FALSE); } ------ This report was generated using AI technology. Always review AI-generated content prior to use