CVE-2026-119079: Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Algorithmic complexity DoS in ASN.1 decodesequenceof() (unauthenticated KDC request parsing): repeated crafted AS-REQ or TGS-REQ messages can force one-by-one array growth while decoding PrincipalName.name-string, causing substantial CPU consumption in krb5kdc before authentication. Requirements to exploit: An unauthenticated attacker needs network reachability to a deployed krb5kdc over TCP and the ability to send repeated, syntactically valid, large AS-REQ or TGS-REQ messages containing a very large PrincipalName.name-string SEQUENCE OF GeneralString. No credentials or user interaction are required. Component affected: krb5 SRPM; src/lib/krb5/asn.1/asn1encode.c in decodesequenceof(), reachable from src/kdc/dispatch.c during decodekrb5asreq() and decodekrb5tgsreq(). One practical trigger is PrincipalName.name-string in src/lib/krb5/asn.1/asn1kencode.c. Version affected: krb5-1.21.3-8.el100 when deployed with the KDC service reachable over TCP Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - 5.3 (MEDIUM) AV:N - The expensive decode path is reachable over the network through KDC TCP request handling. AC:L - The attacker only needs to send crafted large AS-REQ or TGS-REQ messages with many short sequence elements; no race or unusual preconditions are established. PR:N - The affected decode path runs before authentication. UI:N - No user interaction is required. S:U - The impact is limited to the KDC service within its own security scope. C:N - No confidentiality impact is shown. I:N - No integrity impact is shown. A:L - The availability impact is real but bounded by the roughly 1 MiB request cap and TCP/RPC active-connection limits; the evidence supports practical service degradation and CPU exhaustion, not permanent or system-wide loss. Impact: Important. The issue enables unauthenticated remote denial of service against a deployed KDC over TCP. Although the CVSS availability metric is Low because the work per request is bounded by request-size and connection limits, Red Hat guidance classifies remote denial of service by remote users as Important; the evidence does not support Critical because no confidentiality, integrity, or code-execution impact is shown. Embargo: no Reason: This is a bounded, availability-only issue with practical operational mitigations, so it does not present the same silent-compromise risk that usually justifies embargo for confidentiality, integrity, or code-execution flaws. Acknowledgement: Aisle Research Vulnerability Details: decodesequenceof() grows the destination array by one element per loop iteration: c / src/lib/krb5/asn.1/asn1encode.c / while (len > 0) { ... newseq = realloc(seq, (count + 1) elemtype->size); if (newseq == NULL) { ret = ENOMEM; goto error; } seq = newseq; ... ret = decodeatype(&t, contents, clen, elemtype, elem); ... count++; } The KDC decodes AS-REQ and TGS-REQ messages before authentication: c / src/kdc/dispatch.c / if (krb5istgsreq(pkt)) retval = decodekrb5tgsreq(pkt, &req); else if (krb5isasreq(pkt)) retval = decodekrb5asreq(pkt, &req); One practical trigger is PrincipalName.name-string, which is defined as a counted SEQUENCE OF GeneralString: c / src/lib/krb5/asn.1/asn1kencode.c / DEFCNFIELD(princname1, krb5principaldata, data, length, 1, cseqofgstringdata); KDC TCP input accepts messages up to approximately 1,048,572 bytes of payload, and the server code also enforces a TCP/RPC active-connection cap of 45. Those bounds limit the worst case, but they do not remove the core behavior: a remote attacker can still force one realloc() per decoded element in a pre-auth KDC path by submitting repeated near-cap TCP requests with a very large number of short principal components. The result is attacker-controlled CPU consumption and degraded KDC availability before authentication or request policy checks occur. The available evidence supports this issue for the KDC TCP path. This report does not rely on equivalent reachability over UDP-sized requests, and it does not assert comparable unauthenticated reachability for other daemons. Steps to reproduce: 1. Build and run krb5kdc from krb5-1.21.3-8.el100 with its TCP listener reachable on port 88/TCP. 2. Craft an AS-REQ or TGS-REQ where PrincipalName.name-string contains a very large number of short GeneralString elements, keeping the overall request size just below the TCP payload cap of 1,048,572 bytes. 3. Send the crafted requests repeatedly over TCP from one or more clients. 4. Observe elevated CPU usage in krb5kdc during ASN.1 decode, before authentication completes, together with degraded response time for legitimate requests. 5. Instrument decodesequenceof() if needed and confirm that the number of realloc() calls grows with the number of elements in the sequence. Mitigation: Until a fix is available, limit KDC TCP exposure to trusted networks and apply network-level rate limiting or filtering for repeated large Kerberos TCP requests. If the deployment can safely avoid accepting untrusted KDC TCP traffic, that reduces exposure, but this is only a mitigation and not a code-level fix. Proposed Fix: Grow the destination buffer geometrically instead of by one element per iteration, and optionally shrink it once after decoding completes. diff — a/src/lib/krb5/asn.1/asn1encode.c +++ b/src/lib/krb5/asn.1/asn1encode.c @@ static krb5errorcode decodesequenceof(const uint8t asn1, sizet len, const struct atypeinfo elemtype, void seqout, sizet countout) { krb5errorcode ret; void seq = NULL, elem, newseq; const uint8t contents; sizet clen, count = 0; + sizet clen, count = 0, capacity = 0, newcap; taginfo t; @@

newseq = realloc(seq, (count + 1) elemtype->size);

if (newseq == NULL) {

ret = ENOMEM;

goto error; + if (count == capacity) { + newcap = (capacity == 0) ? 8 : capacity 2; + if (newcap < count + 1 || newcap > SIZEMAX / elemtype->size) { + ret = ASN1OVERFLOW; + goto error; + } + newseq = realloc(seq, newcap elemtype->size); + if (newseq == NULL) { + ret = ENOMEM; + goto error; + } + seq = newseq; + capacity = newcap; }

seq = newseq; elem = (char )seq + count elemtype->size; memset(elem, 0, elemtype->size); ret = decodeatype(&t, contents, clen, elemtype, elem); if (ret) goto error; count++; } + if (count > 0 && count < capacity) { + newseq = realloc(seq, count elemtype->size); + if (newseq != NULL) + seq = newseq; + } seqout = seq; countout = count; return 0;

------ This report was generated using AI technology. Always review AI-generated content prior to use