[krbdev.mit.edu #5856] double-free in gss_krb5int_make_seal_token_v3() [CVE-2007-5971]

[Tom Yu via RT]

This is one of the Venustech AD-LAB alleged vulnerabilities.

CVE-2007-5971
http://bugs.gentoo.org/show_bug.cgi?id=199212

This bug is a double-free condition which is not a practical
vulnerability due to the extreme difficulty of exploitation.  If
krb5_c_make_checksum() (in src/lib/gssapi/krb5/k5sealv3.c) fails,
"outbuf" may be freed twice.

   244          err = krb5_c_make_checksum(context, ctx->cksumtype, key,
   245                                     key_usage, &plain, &sum);
   246          zap(plain.data, plain.length);
   247          free(plain.data);
   248          plain.data = 0;
   249          if (err) {
   250              zap(outbuf,bufsize);
   251              free(outbuf);
   252              goto error;
   253          }
...
   290  error:
   291      free(outbuf);
   292      token->value = NULL;
   293      token->length = 0;
   294      return err;
   295  }

krb5_c_make_checksum() only fails if malloc() fails to allocate a very
small amount of memory.  To exploit this vulnerability, an attacker
would need to force a malloc() failure at exactly the point where
krb5_c_make_checksum is called.