krb5 commit: Prevent null dereference in PKINIT CMS processing

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/6a5d772002c1764bd14934ccb6684f0cce15d617
commit 6a5d772002c1764bd14934ccb6684f0cce15d617
Author: Greg Hudson <ghudson at mit.edu>
Date:   Sun Aug 2 21:44:11 2026 -0400

    Prevent null dereference in PKINIT CMS processing
    
    In cms_signeddata_verify(), where we use CMS_get0_content(), check
    that the dereferenced result is non-null as well as the result itself.
    (The result itself is a pointer to the eContent slot, whether or not
    the decoded ASN.1 value contained an eContent field, and will only be
    null if the CMS_ContentInfo object has an unexpected type.)
    
    CVE-2026-71200:
    
    If a KDC is configured to allow PKINIT authentication, an
    unauthenticated attacker can trigger a null pointer dereference,
    causing the process to terminate.  Discovered by Claude and Ada
    Logics, and independently by Erin Liman using DeepSeek.
    
    ticket: 9227 (new)
    tags: pullup
    target_version: 1.22-next

 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index a435847a4..ba40abc4b 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -1691,7 +1691,8 @@ cms_signeddata_verify(krb5_context context,
         unsigned char *d;
         *is_signed = 0;
         octets = CMS_get0_content(cms);
-        if (!octets || (ASN1_STRING_type(*octets) != V_ASN1_OCTET_STRING)) {
+        if (octets == NULL || *octets == NULL ||
+            (ASN1_STRING_type(*octets) != V_ASN1_OCTET_STRING)) {
             retval = KRB5KDC_ERR_PREAUTH_FAILED;
             krb5_set_error_message(context, retval,
                                    _("Invalid pkinit packet: octet string "
@@ -1746,9 +1747,10 @@ cms_signeddata_verify(krb5_context context,
         *is_signed = 0;
         /* We cannot use CMS_dataInit because there may be no digest */
         octets = CMS_get0_content(cms);
-        if (octets)
+        if (octets != NULL && *octets != NULL) {
             out = BIO_new_mem_buf(ASN1_STRING_get0_data(*octets),
                                   ASN1_STRING_length(*octets));
+        }
         if (out == NULL)
             goto cleanup;
     } else {