krb5 commit: Fix leak in RPC client on mismatched ID

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/aac40ec59fd4ffa126e19749e85ddb913892fe53
commit aac40ec59fd4ffa126e19749e85ddb913892fe53
Author: Julien Rische <jrische at redhat.com>
Date:   Thu Sep 3 17:49:25 2026 +0200

    Fix leak in RPC client on mismatched ID
    
    In clnttcp_call(), before decoding a reply, free the verifier in
    reply_msg if one was allocated when decoding a previous reply.
    
    [ghudson at mit.edu: moved ar_verf/ar_results setting back outside of
    conditional; switched to using xdr_free() for brevity]
    
    CVE-2026-112314:
    
    clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does
    not free the RPC reply verifier between retries, which allows remote
    attackers to cause a denial of service (memory leak in GSS-RPC client
    programs) by injecting RPC replies with mismatched XIDs or by
    triggering authentication retries.
    
    ticket: 9258 (new)
    tags: pullup
    target_version: 1.22-next

 src/lib/rpc/clnt_tcp.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/lib/rpc/clnt_tcp.c b/src/lib/rpc/clnt_tcp.c
index dbd62d0a7..2e058e58c 100644
--- a/src/lib/rpc/clnt_tcp.c
+++ b/src/lib/rpc/clnt_tcp.c
@@ -254,7 +254,7 @@ clnttcp_call(
 {
 	struct ct_data *ct = h->cl_private;
 	XDR *xdrs = &ct->ct_xdrs;
-	struct rpc_msg reply_msg;
+	struct rpc_msg reply_msg = { 0 };
 	uint32_t x_id;
 	uint32_t *msg_x_id = &ct->ct_u.ct_mcalli;	/* yuk */
 	bool_t shipnow;
@@ -299,6 +299,11 @@ call_again:
 	 */
 	xdrs->x_op = XDR_DECODE;
 	while (TRUE) {
+		/* Free verifier buffer if set from previous decode. */
+		if (reply_msg.rm_reply.rp_stat == MSG_ACCEPTED) {
+		    xdr_free((xdrproc_t)xdr_opaque_auth,
+			     &reply_msg.acpted_rply.ar_verf);
+		}
 		reply_msg.acpted_rply.ar_verf = gssrpc__null_auth;
 		reply_msg.acpted_rply.ar_results.where = NULL;
 		reply_msg.acpted_rply.ar_results.proc = xdr_void;