CVE-2026-112322: Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Unauthenticated CPU DoS in AUTHGSSAPI client cleanup (svcauthgssapi.c): quadratic cleanup of expired AUTHGSSAPI client state can be triggered remotely by accumulating partial AUTHGSSAPIINIT entries and then forcing rescans of mixed live and expired records. Requirements to exploit: Network reachability to a service shipped in this SRPM that accepts the legacy AUTHGSSAPI server path, such as kadmind; no credentials or user interaction are required, but the attacker must sustain crafted AUTHGSSAPIINIT traffic across the INITIATIONTIMEOUT window to build up expiring client records. Component affected: krb5-1.21.3-8.el100, src/lib/rpc/svcauthgssapi.c (cleanclient(), createclient(), and pre-auth AUTHGSSAPIINIT handling) Version affected: krb5-1.21.3-8.el100 when a network-reachable service from this SRPM uses the legacy AUTHGSSAPI server path, such as kadmind Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 7.5 (HIGH) AV:N - The issue is triggered by network requests to a service such as kadmind. AC:L - The attacker only needs repeated unauthenticated AUTHGSSAPIINIT requests over the normal timeout window; no race or special environment is required. PR:N - No prior authentication is needed to create the partial client records involved in cleanup. UI:N - The attack is fully programmatic and does not require user participation. S:U - The impact is confined to the vulnerable service process. C:N - No confidentiality impact is established by the available evidence. I:N - No integrity impact is established by the available evidence. A:H - Cleanup can be forced into excessive CPU work, causing prolonged loss of service availability. Impact: Important. This matches Red Hat's Important rating because the available evidence supports an unauthenticated remote denial of service against a network-reachable service from this SRPM that uses the legacy AUTHGSSAPI path. Critical is not appropriate because no confidentiality, integrity, or code-execution impact is shown. Embargo: no Reason: The issue is availability-only, and exploitation still depends on a reachable service exposing legacy AUTHGSSAPI plus sustained request shaping over the initiation timeout window. Restricting access to kadmind or similar RPC services provides an operational mitigation while a fix is prepared. Acknowledgement: Aisle Research Vulnerability Details: cleanclient() removes expired AUTHGSSAPI client state, but after deleting one expired entry it restarts scanning from the head of the global client list: c static void cleanclient(void) { svcauthgssapidata clientdata; clientlist c; c = clients; while (c) { clientdata = c->client; if (clientdata->expiration < time(0)) { destroyclient(clientdata); c = clients; / start over, just to be safe / } else { c = c->next; } } } New client records are prepended to that list: c if (clients == NULL) clients = c; else { c->next = clients; clients = c; } Unauthenticated AUTHGSSAPIINIT handling creates a client record before context establishment succeeds: c / clean up expired entries / cleanclient(); if (creds.authmsg && rqst->rqproc == AUTHGSSAPIINIT) { clientdata = createclient(); ... } If gssacceptseccontext() later fails, the partial record remains until timeout-based cleanup rather than being destroyed immediately. Because newer entries are added at the head and older entries expire at the tail, an attacker can shape a list with a live prefix and an expired suffix. Each expired entry then causes another scan across the live prefix, turning one cleanup pass into quadratic CPU work. In affected deployments, kadmind explicitly enables the older AUTHGSSAPI server path via svcauthgssapisetnames(...), so this is not just unreachable dead code for that service path. Steps to reproduce: 1. Start kadmind (or another service using this AUTHGSSAPI path) with network access to the attacker. 2. Send many RPC calls with oaflavor=AUTHGSSAPI, creds version=2, authmsg=true, rqproc=AUTHGSSAPIINIT, and empty clienthandle. An invalid init token is sufficient if it fails after createclient() executes. 3. Continue sending INIT requests over roughly 15 minutes (INITIATIONTIMEOUT) so older partial entries expire while newer ones remain fresh. 4. Send one additional AUTHGSSAPI request to trigger cleanclient(). 5. Observe a CPU spike and elevated latency while cleanup repeatedly rescans the live prefix of the list. Mitigation: Restrict network access to kadmind and any other service from this SRPM that accepts legacy AUTHGSSAPI requests to trusted management hosts only. If possible, rate-limit or filter repeated unauthenticated AUTHGSSAPIINIT RPC traffic at the network boundary. If a deployment can avoid exposing the legacy AUTHGSSAPI server path and rely on RPCSECGSS instead, that would reduce exposure, although the available material does not establish a universal supported switch for every packaged deployment. Proposed Fix: This patch removes head-restart behavior and list rescans by unlinking expired entries in-place via a pointer-to-pointer walk, while preserving existing destroyclient() behavior for other callers. diff diff --git a/src/lib/rpc/svcauthgssapi.c b/src/lib/rpc/svcauthgssapi.c — a/src/lib/rpc/svcauthgssapi.c +++ b/src/lib/rpc/svcauthgssapi.c @@ -104,6 +104,7 @@ static svcauthgssapidata getclient (gssbuffert clienthandle); static void destroyclient (svcauthgssapidata clientdata); +static void freeclientdata(svcauthgssapidata clientdata); static void cleanclient(void), cleanup(void); static void clientexpire (svcauthgssapidata clientdata, uint32t exp); @@ -818,6 +819,29 @@ static svcauthgssapidata getclient(gssbuffert clienthandle) freed. / static void destroyclient(svcauthgssapidata clientdata) +{ + clientlist c, c2; + + if (clients == NULL) { + PRINTF(("destroyclient: called on empty database\n")); + abort(); + } else if (clients->client == clientdata) { + c = clients; + clients = clients->next; + free(c); + } else { + c2 = clients; + c = clients->next; + while (c) { + if (c->client == clientdata) { + c2->next = c->next; + free(c); + goto unlinked; + } + c2 = c; + c = c->next; + } + PRINTF(("destroyclient: clienthandle delete failed\n")); + abort(); + } +unlinked: + freeclientdata(clientdata); +} + +static void freeclientdata(svcauthgssapidata clientdata) { OMuint32 gssstat, minorstat; gssbufferdesc outbuf;

clientlist c, c2; @@ -841,31 +865,6 @@ static void destroyclient(svcauthgssapidata clientdata) if (clientdata->prevverf.length != 0) gssreleasebuffer(&minorstat, &clientdata->prevverf);

if (clients == NULL) {

PRINTF(("destroyclient: called on empty database\n"));

abort();

} else if (clients->client == clientdata) {

c = clients;

clients = clients->next;

free(c);

} else {

c2 = clients;

c = clients->next;

while (c) {

if (c->client == clientdata) {

c2->next = c->next;

free(c);

goto done;

} else {

c2 = c;

c = c->next;

}

}

PRINTF(("destroyclient: clienthandle delete failed\n"));

abort();

} - -done: - LPRINTF(2, ("destroyclient: client %d destroyed\n", clientdata->key));

free(clientdata); @@ -895,25 +894,27 @@ static void cleanclient(void) { svcauthgssapidata clientdata; clientlist c; + clientlist pp, cur; + timet now;

PRINTF(("cleanclient: starting\n")); c = clients;

while (c) {

clientdata = c->client; + now = time(0); + pp = &clients; + while ((cur = pp) != NULL) { + clientdata = cur->client;

LPRINTF(2, ("cleanclient: clientdata = %p\n", (void ) clientdata)); if (clientdata->expiration < time(0)) { + if (clientdata->expiration < now) { PRINTF(("cleanclient: client %d expired\n", clientdata->key));

destroyclient(clientdata);

c = clients; / start over, just to be safe / + pp = cur->next; + free(cur); + freeclientdata(clientdata); } else {

c = c->next; + pp = &cur->next; } } - PRINTF(("cleanclient: done\n")); }

------ This report was generated using AI technology. Always review AI-generated content prior to use