Browse files

KDC null deref due to referrals [CVE-2013-1417]

An authenticated remote client can cause a KDC to crash by making a
valid TGS-REQ to a KDC serving a realm with a single-component name.
The process_tgs_req() function dereferences a null pointer because an
unusual failure condition causes a helper function to return success.

While attempting to provide cross-realm referrals for host-based
service principals, the find_referral_tgs() function could return a
TGS principal for a zero-length realm name (indicating that the
hostname in the service principal has no known realm associated with

Subsequently, the find_alternate_tgs() function would attempt to
construct a path to this empty-string realm, and return success along
with a null pointer in its output parameter.  This happens because
krb5_walk_realm_tree() returns a list of length one when it attempts
to construct a transit path between a single-component realm and the
empty-string realm.  This list causes a loop in find_alternate_tgs()
to iterate over zero elements, resulting in the unexpected output of a
null pointer, which process_tgs_req() proceeds to dereference because
there is no error condition.

Add an error condition to find_referral_tgs() when
krb5_get_host_realm() returns an empty realm name.  Also add an error
condition to find_alternate_tgs() to handle the length-one output from

The vulnerable configuration is not likely to arise in practice.
(Realm names that have a single component are likely to be test
realms.)  Releases prior to krb5-1.11 are not vulnerable.

Thanks to Sol Jerome for reporting this problem.


(cherry picked from commit 3c7f1c2)

ticket: 7668
version_fixed: 1.11.4
status: resolved
  • Loading branch information...
1 parent 6d6a8b0 commit 4c023ba43c16396f0d199e2df1cfa59b88b62acc @tlyu tlyu committed Jun 21, 2013
Showing with 3 additions and 1 deletion.
  1. +3 −1 src/kdc/do_tgs_req.c
@@ -1057,6 +1057,8 @@ find_alternate_tgs(kdc_realm_t *kdc_active_realm, krb5_principal princ,
goto cleanup;
+ if (retval == 0 && server_ptr == NULL)
+ retval = KRB5_KDB_NOENTRY;
if (retval != 0)
*status = "UNKNOWN_SERVER";
@@ -1149,7 +1151,7 @@ find_referral_tgs(kdc_realm_t *kdc_active_realm, krb5_kdc_req *request,
goto cleanup;
/* Don't return a referral to the empty realm or the service realm. */
- if (realms == NULL || realms[0] == '\0' ||
+ if (realms == NULL || realms[0] == NULL || *realms[0] == '\0' ||
data_eq_string(srealm, realms[0])) {
goto cleanup;

0 comments on commit 4c023ba

Please sign in to comment.