CVE-2026-112323: Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Unauthenticated Memory-Exhaustion DoS in kadmind legacy AUTHGSSAPI handshake (svcauthgssapi.c): repeated unauthenticated AUTHGSSAPIINIT failures can allocate per-client state that is retained until timeout-based cleanup, allowing remote memory-pressure denial of service. Requirements to exploit: Network reachability to a kadmind admin RPC endpoint and the ability to send crafted unauthenticated AUTHGSSAPIINIT requests that reach the legacy server-side AUTHGSSAPI handler; no valid Kerberos credentials or user interaction are required. Component affected: krb5-1.21.3-8.el100, src/lib/rpc/svcauthgssapi.c, gssrpcsvcauthgssapi() legacy AUTHGSSAPI handshake path reachable via kadmind Version affected: krb5-1.21.3-8.el100 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 7.5 (HIGH) AV:N - The attack is delivered over the network to a reachable kadmind RPC service. AC:L - Repeated malformed AUTHGSSAPIINIT traffic is sufficient; no race or unusual precondition is established. PR:N - No Kerberos credentials or other prior authentication are required. UI:N - No user interaction is needed. S:U - The impact stays within the authority of the vulnerable service. C:N - No confidentiality impact is established from the available evidence. I:N - No integrity impact is established from the available evidence. A:H - Repeated retained allocations can drive sustained memory growth and deny service. Impact: Important. Red Hat classifies flaws that allow remote users to cause a denial of service as Important when they can compromise availability of resources. Here, the established effect is unauthenticated remote memory exhaustion against a reachable kadmind service. Critical is not supported because the evidence does not show arbitrary code execution or broader system compromise, and the demonstrated impact is availability-only. Embargo: no Reason: The established impact is denial of service on an administrative service, and exposure can be materially reduced by restricting network access to kadmind while a fix is prepared. Private coordination is still useful, but the currently established impact does not strongly support an extended embargo. Acknowledgement: Aisle Research Vulnerability Details: In gssrpcsvcauthgssapi(), an AUTHGSSAPIINIT request with an empty client handle creates new per-client state before context establishment. That state is inserted into the global clients list and given a 15-minute initiation timeout. When context establishment fails, the function sends an error response and returns through error: without destroying the just-created entry. c if (creds.authmsg && rqst->rqproc == AUTHGSSAPIINIT) { ... clientdata = createclient(); ... } c clientdata->expiration = time(0) + INITIATIONTIMEOUT; / 6015 / c if (callres.gssmajor != GSSSCOMPLETE && callres.gssmajor != GSSSCONTINUENEEDED) { ... svcsendreply(...); nodispatch = TRUE; ret = AUTHOK; goto error; / no destroyclient(clientdata) / } Repeated unauthenticated failures therefore accumulate retained svcauthgssapidata entries until timeout-based cleanup runs. The same cleanup gap also affects other post-allocation INIT failure paths that return through error: after createclient() has already succeeded, including malformed init arguments or unsupported INIT versions. Based on the available evidence, the established impact is denial of service through attacker-driven memory growth; no confidentiality or integrity impact is established. Steps to reproduce: 1. Run kadmind from this package and ensure the admin RPC service is reachable, typically on 749/tcp. 2. Open one TCP connection to the service. 3. Repeatedly send RPC calls with credential flavor AUTHGSSAPI, procedure AUTHGSSAPIINIT, authmsg = TRUE, an empty clienthandle, and an invalid or malformed init token. Malformed INIT arguments after credential parsing also exercise post-allocation failure handling. 4. Observe that failed INIT requests return an error response while also yielding a fresh clienthandle, indicating that new server-side client state was created. 5. Continue sending failures at a moderate rate and monitor kadmind memory usage. Memory rises and remains elevated until the initiation timeout expires (about 15 minutes), demonstrating unauthenticated memory-pressure denial of service. Mitigation: Restrict network access to the kadmind admin RPC service to trusted management hosts, and apply network filtering or rate limiting for repeated failed AUTHGSSAPIINIT traffic where possible. Until a fix is available, avoid exposing this administrative interface to untrusted networks and monitor kadmind for abnormal memory growth. Proposed Fix: Track whether the current request created a new client entry and destroy that entry on all failure exits so partially initialized state is not left in the global client list. diff — a/src/lib/rpc/svcauthgssapi.c +++ b/src/lib/rpc/svcauthgssapi.c @@ -170,6 +170,7 @@ enum authstat gssrpcsvcauthgssapi( enum authstat ret; OMuint32 retflags; uint32t seqnum; + boolt createdclient = FALSE; @@ -248,6 +249,7 @@ enum authstat gssrpcsvcauthgssapi( if (clientdata == NULL) { ... } + createdclient = TRUE; } else { ... } @@ -461,6 +463,12 @@ enum authstat gssrpcsvcauthgssapi( gssreleasebuffer(&minorstat, &outputtoken); + if (createdclient) { + destroyclient(clientdata); + clientdata = NULL; + rqst->rqxprt->xpauth = &svcauthnone; + createdclient = FALSE; + } svcsendreply(rqst->rqxprt, (xdrproct)xdrauthgssapiinitres, (caddrt) &callres); nodispatch = TRUE; @@ -652,6 +660,12 @@ error: + if (createdclient && clientdata != NULL) { + destroyclient(clientdata); + clientdata = NULL; + rqst->rqxprt->xpauth = &svcauthnone; + createdclient = FALSE; + } if (creds.clienthandle.length != 0) { ... } ------ This report was generated using AI technology. Always review AI-generated content prior to use