krb5 commit: Prevent null dereferences in kadmind server stubs

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/407e75e927c1870161305d3288cc0205e9ff067b
commit 407e75e927c1870161305d3288cc0205e9ff067b
Author: Greg Hudson <ghudson at mit.edu>
Date:   Tue Oct 20 12:00:23 2026 -0400

    Prevent null dereferences in kadmind server stubs
    
    In server_stubs.c, when a stub function uses a policy name as
    prime_arg, check for a null value and return an error.
    
    CVE-2026-112318:
    
    The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5
    (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by
    xdr_nullstring(), which allows remote authenticated users to cause a
    denial of service (kadmind crash via NULL pointer dereference) by
    sending a policy request with an empty policy name that reaches
    authorization checks or logging code.
    
    ticket: 9265 (new)
    tags: pullup
    target_version: 1.22-next

 src/kadmin/server/server_stubs.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
index 7fd980794..e36c91322 100644
--- a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -1261,6 +1261,10 @@ create_policy_2_svc(cpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
         goto exit_func;
 
     prime_arg = arg->rec.policy;
+    if (prime_arg == NULL) {
+        ret->code = EINVAL;
+        goto exit_func;
+    }
 
     if (CHANGEPW_SERVICE(rqstp) ||
         !stub_auth_pol(handle, OP_ADDPOL, arg->rec.policy,
@@ -1274,8 +1278,7 @@ create_policy_2_svc(cpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
         if (ret->code != 0)
             errmsg = krb5_get_error_message(handle->context, ret->code);
 
-        log_done("kadm5_create_policy",
-                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
+        log_done("kadm5_create_policy", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1303,6 +1306,10 @@ delete_policy_2_svc(dpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
         goto exit_func;
 
     prime_arg = arg->name;
+    if (prime_arg == NULL) {
+        ret->code = EINVAL;
+        goto exit_func;
+    }
 
     if (CHANGEPW_SERVICE(rqstp) ||
         !stub_auth(handle, OP_DELPOL, NULL, NULL, arg->name, NULL)) {
@@ -1314,8 +1321,7 @@ delete_policy_2_svc(dpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
         if (ret->code != 0)
             errmsg = krb5_get_error_message(handle->context, ret->code);
 
-        log_done("kadm5_delete_policy",
-                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
+        log_done("kadm5_delete_policy", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1343,6 +1349,10 @@ modify_policy_2_svc(mpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
         goto exit_func;
 
     prime_arg = arg->rec.policy;
+    if (prime_arg == NULL) {
+        ret->code = EINVAL;
+        goto exit_func;
+    }
 
     if (CHANGEPW_SERVICE(rqstp) ||
         !stub_auth_pol(handle, OP_MODPOL, arg->rec.policy,
@@ -1355,8 +1365,7 @@ modify_policy_2_svc(mpol_arg *arg, generic_ret *ret, struct svc_req *rqstp)
         if (ret->code != 0)
             errmsg = krb5_get_error_message(handle->context, ret->code);
 
-        log_done("kadm5_modify_policy",
-                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
+        log_done("kadm5_modify_policy", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1390,6 +1399,10 @@ get_policy_2_svc(gpol_arg *arg, gpol_ret *ret, struct svc_req *rqstp)
     funcname = "kadm5_get_policy";
 
     prime_arg = arg->name;
+    if (prime_arg == NULL) {
+        ret->code = EINVAL;
+        goto exit_func;
+    }
 
     /* Look up the client principal's policy value. */
     ret2 = kadm5_get_principal(handle->lhandle, handle->current_caller,
@@ -1408,9 +1421,8 @@ get_policy_2_svc(gpol_arg *arg, gpol_ret *ret, struct svc_req *rqstp)
         if (ret->code != 0)
             errmsg = krb5_get_error_message(handle->context, ret->code);
 
-        log_done(funcname,
-                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
-                 &client_name, &service_name, rqstp);
+        log_done(funcname, prime_arg, errmsg, &client_name, &service_name,
+                 rqstp);
         if (errmsg != NULL)
             krb5_free_error_message(handle->context, errmsg);
     }