Message ID | 20210915194819.841337-1-fontaine.fabrice@gmail.com |
---|---|
State | Accepted |
Headers | show |
Series | [1/1] package/libkrb5: fix CVE-2021-37750 | expand |
Fabrice, All, On 2021-09-15 21:48 +0200, Fabrice Fontaine spake thusly: > The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before > 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in > kdc/do_tgs_req.c via a FAST inner body that lacks a server field. > > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Applied to master, thanks. Regards, Yann E. MORIN. > --- > ...-deref-on-TGS-inner-body-null-server.patch | 47 +++++++++++++++++++ > package/libkrb5/libkrb5.mk | 3 ++ > 2 files changed, 50 insertions(+) > create mode 100644 package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch > > diff --git a/package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch b/package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch > new file mode 100644 > index 0000000000..ec6f623380 > --- /dev/null > +++ b/package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch > @@ -0,0 +1,47 @@ > +From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 > +From: Greg Hudson <ghudson@mit.edu> > +Date: Tue, 3 Aug 2021 01:15:27 -0400 > +Subject: [PATCH] Fix KDC null deref on TGS inner body null server > + > +After the KDC decodes a FAST inner body, it does not check for a null > +server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this > +would typically result in an error from krb5_unparse_name(), but with > +the addition of get_local_tgt() it results in a null dereference. Add > +a null check. > + > +Reported by Joseph Sutton of Catalyst. > + > +CVE-2021-37750: > + > +In MIT krb5 releases 1.14 and later, an authenticated attacker can > +cause a null dereference in the KDC by sending a FAST TGS request with > +no server field. > + > +ticket: 9008 (new) > +tags: pullup > +target_version: 1.19-next > +target_version: 1.18-next > + > +[Retrieved from: > +https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49] > +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> > +--- > + src/kdc/do_tgs_req.c | 5 +++++ > + 1 file changed, 5 insertions(+) > + > +diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c > +index 582e497cc9..32dc65fa8e 100644 > +--- a/src/kdc/do_tgs_req.c > ++++ b/src/kdc/do_tgs_req.c > +@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, > + status = "FIND_FAST"; > + goto cleanup; > + } > ++ if (sprinc == NULL) { > ++ status = "NULL_SERVER"; > ++ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; > ++ goto cleanup; > ++ } > + > + errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, > + &local_tgt, &local_tgt_storage, &local_tgt_key); > diff --git a/package/libkrb5/libkrb5.mk b/package/libkrb5/libkrb5.mk > index 89f219d913..d41e7559a5 100644 > --- a/package/libkrb5/libkrb5.mk > +++ b/package/libkrb5/libkrb5.mk > @@ -16,6 +16,9 @@ LIBKRB5_CPE_ID_PRODUCT = kerberos_5 > LIBKRB5_DEPENDENCIES = host-bison $(TARGET_NLS_DEPENDENCIES) > LIBKRB5_INSTALL_STAGING = YES > > +# 0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch > +LIBKRB5_IGNORE_CVES += CVE-2021-37750 > + > # The configure script uses AC_TRY_RUN tests to check for those values, > # which doesn't work in a cross-compilation scenario. Therefore, > # we feed the configure script with the correct answer for those tests > -- > 2.33.0 > > _______________________________________________ > buildroot mailing list > buildroot@lists.buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot
diff --git a/package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch b/package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch new file mode 100644 index 0000000000..ec6f623380 --- /dev/null +++ b/package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch @@ -0,0 +1,47 @@ +From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 +From: Greg Hudson <ghudson@mit.edu> +Date: Tue, 3 Aug 2021 01:15:27 -0400 +Subject: [PATCH] Fix KDC null deref on TGS inner body null server + +After the KDC decodes a FAST inner body, it does not check for a null +server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this +would typically result in an error from krb5_unparse_name(), but with +the addition of get_local_tgt() it results in a null dereference. Add +a null check. + +Reported by Joseph Sutton of Catalyst. + +CVE-2021-37750: + +In MIT krb5 releases 1.14 and later, an authenticated attacker can +cause a null dereference in the KDC by sending a FAST TGS request with +no server field. + +ticket: 9008 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next + +[Retrieved from: +https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49] +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> +--- + src/kdc/do_tgs_req.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c +index 582e497cc9..32dc65fa8e 100644 +--- a/src/kdc/do_tgs_req.c ++++ b/src/kdc/do_tgs_req.c +@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, + status = "FIND_FAST"; + goto cleanup; + } ++ if (sprinc == NULL) { ++ status = "NULL_SERVER"; ++ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; ++ goto cleanup; ++ } + + errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, + &local_tgt, &local_tgt_storage, &local_tgt_key); diff --git a/package/libkrb5/libkrb5.mk b/package/libkrb5/libkrb5.mk index 89f219d913..d41e7559a5 100644 --- a/package/libkrb5/libkrb5.mk +++ b/package/libkrb5/libkrb5.mk @@ -16,6 +16,9 @@ LIBKRB5_CPE_ID_PRODUCT = kerberos_5 LIBKRB5_DEPENDENCIES = host-bison $(TARGET_NLS_DEPENDENCIES) LIBKRB5_INSTALL_STAGING = YES +# 0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch +LIBKRB5_IGNORE_CVES += CVE-2021-37750 + # The configure script uses AC_TRY_RUN tests to check for those values, # which doesn't work in a cross-compilation scenario. Therefore, # we feed the configure script with the correct answer for those tests
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> --- ...-deref-on-TGS-inner-body-null-server.patch | 47 +++++++++++++++++++ package/libkrb5/libkrb5.mk | 3 ++ 2 files changed, 50 insertions(+) create mode 100644 package/libkrb5/0001-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch