Skip to content

Commit d775c95

Browse files
committed
Fix KDC null deref on TGS inner body null server
After the KDC decodes a FAST inner body, it does not check for a null server. Prior to commit 39548a5 this would typically result in an error from krb5_unparse_name(), but with the addition of get_local_tgt() it results in a null dereference. Add a null check. Reported by Joseph Sutton of Catalyst. CVE-2021-37750: In MIT krb5 releases 1.14 and later, an authenticated attacker can cause a null dereference in the KDC by sending a FAST TGS request with no server field. ticket: 9008 (new) tags: pullup target_version: 1.19-next target_version: 1.18-next
1 parent 35fac31 commit d775c95

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

Diff for: src/kdc/do_tgs_req.c

+5
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
204204
status = "FIND_FAST";
205205
goto cleanup;
206206
}
207+
if (sprinc == NULL) {
208+
status = "NULL_SERVER";
209+
errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
210+
goto cleanup;
211+
}
207212

208213
errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
209214
&local_tgt, &local_tgt_storage, &local_tgt_key);

0 commit comments

Comments
 (0)