diff options
author | Greg Hudson <ghudson@mit.edu> | 2021-08-03 01:15:27 -0400 |
---|---|---|
committer | Greg Hudson <ghudson@mit.edu> | 2022-03-09 17:09:14 -0500 |
commit | fd9decf85055acca218c34c9e1222dc692b973d4 (patch) | |
tree | bc4abdbfdb0fe08f97684298fc94b10c7e283f2e | |
parent | 05405c3d24c2d84ba79e355ae82f4b1b9884938c (diff) | |
download | krb5-fd9decf85055acca218c34c9e1222dc692b973d4.zip krb5-fd9decf85055acca218c34c9e1222dc692b973d4.tar.gz krb5-fd9decf85055acca218c34c9e1222dc692b973d4.tar.bz2 |
Fix KDC null deref on TGS inner body null server
After the KDC decodes a FAST inner body, it does not check for a null
server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
would typically result in an error from krb5_unparse_name(), but with
the addition of get_local_tgt() it results in a null dereference. Add
a null check.
Reported by Joseph Sutton of Catalyst.
CVE-2021-37750:
In MIT krb5 releases 1.14 and later, an authenticated attacker can
cause a null dereference in the KDC by sending a FAST TGS request with
no server field.
(cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49)
ticket: 9008
version_fixed: 1.18.5
-rw-r--r-- | src/kdc/do_tgs_req.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 241f34e..386ed5f 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -208,6 +208,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, status = "FIND_FAST"; goto cleanup; } + if (sprinc == NULL) { + status = "NULL_SERVER"; + errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; + goto cleanup; + } errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, &local_tgt, &local_tgt_storage, &local_tgt_key); |