Skip to content

Commit 3db8dfe

Browse files
committed
Fix IAKERB context export/import [CVE-2015-2698]
The patches for CVE-2015-2696 contained a regression in the newly added IAKERB iakerb_gss_export_sec_context() function, which could cause it to corrupt memory. Fix the regression by properly dereferencing the context_handle pointer before casting it. Also, the patches did not implement an IAKERB gss_import_sec_context() function, under the erroneous belief that an exported IAKERB context would be tagged as a krb5 context. Implement it now to allow IAKERB contexts to be successfully exported and imported after establishment. CVE-2015-2698: In any MIT krb5 release with the patches for CVE-2015-2696 applied, an application which calls gss_export_sec_context() may experience memory corruption if the context was established using the IAKERB mechanism. Historically, some vulnerabilities of this nature can be translated into remote code execution, though the necessary exploits must be tailored to the individual application and are usually quite complicated. CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C ticket: 8273 (new) target_version: 1.14 tags: pullup
1 parent 92d6dd0 commit 3db8dfe

File tree

3 files changed

+41
-8
lines changed

3 files changed

+41
-8
lines changed

Diff for: src/lib/gssapi/krb5/gssapiP_krb5.h

+5
Original file line numberDiff line numberDiff line change
@@ -1397,6 +1397,11 @@ OM_uint32 KRB5_CALLCONV
13971397
iakerb_gss_export_sec_context(OM_uint32 *minor_status,
13981398
gss_ctx_id_t *context_handle,
13991399
gss_buffer_t interprocess_token);
1400+
1401+
OM_uint32 KRB5_CALLCONV
1402+
iakerb_gss_import_sec_context(OM_uint32 *minor_status,
1403+
const gss_buffer_t interprocess_token,
1404+
gss_ctx_id_t *context_handle);
14001405
#endif /* LEAN_CLIENT */
14011406

14021407
OM_uint32 KRB5_CALLCONV

Diff for: src/lib/gssapi/krb5/gssapi_krb5.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -970,7 +970,7 @@ static struct gss_config iakerb_mechanism = {
970970
NULL,
971971
#else
972972
iakerb_gss_export_sec_context,
973-
NULL,
973+
iakerb_gss_import_sec_context,
974974
#endif
975975
krb5_gss_inquire_cred_by_mech,
976976
krb5_gss_inquire_names_for_mech,

Diff for: src/lib/gssapi/krb5/iakerb.c

+35-7
Original file line numberDiff line numberDiff line change
@@ -1057,7 +1057,7 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status,
10571057
gss_buffer_t interprocess_token)
10581058
{
10591059
OM_uint32 maj;
1060-
iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
1060+
iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle;
10611061

10621062
/* We don't currently support exporting partially established contexts. */
10631063
if (!ctx->established)
@@ -1072,13 +1072,41 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status,
10721072
return maj;
10731073
}
10741074

1075-
/*
1076-
* Until we implement partial context exports, there are no IAKERB exported
1077-
* context tokens, only tokens for the underlying krb5 context. So we do not
1078-
* need to implement an iakerb_gss_import_sec_context() yet; it would be
1079-
* unreachable except via a manually constructed token.
1080-
*/
1075+
OM_uint32 KRB5_CALLCONV
1076+
iakerb_gss_import_sec_context(OM_uint32 *minor_status,
1077+
gss_buffer_t interprocess_token,
1078+
gss_ctx_id_t *context_handle)
1079+
{
1080+
OM_uint32 maj, tmpmin;
1081+
krb5_error_code code;
1082+
gss_ctx_id_t gssc;
1083+
krb5_gss_ctx_id_t kctx;
1084+
iakerb_ctx_id_t ctx;
1085+
1086+
maj = krb5_gss_import_sec_context(minor_status, interprocess_token, &gssc);
1087+
if (maj != GSS_S_COMPLETE)
1088+
return maj;
1089+
kctx = (krb5_gss_ctx_id_t)gssc;
1090+
1091+
if (!kctx->established) {
1092+
/* We don't currently support importing partially established
1093+
* contexts. */
1094+
krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER);
1095+
return GSS_S_FAILURE;
1096+
}
10811097

1098+
code = iakerb_alloc_context(&ctx, kctx->initiate);
1099+
if (code != 0) {
1100+
krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER);
1101+
*minor_status = code;
1102+
return GSS_S_FAILURE;
1103+
}
1104+
1105+
ctx->gssc = gssc;
1106+
ctx->established = 1;
1107+
*context_handle = (gss_ctx_id_t)ctx;
1108+
return GSS_S_COMPLETE;
1109+
}
10821110
#endif /* LEAN_CLIENT */
10831111

10841112
OM_uint32 KRB5_CALLCONV

0 commit comments

Comments
 (0)