krb5 commit [krb5-1.22]: Fix leak on error in krb5_ktkdb_get_entry()

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/f2cc346aed8643cc38aabe5ad15f4f72113b52af
commit f2cc346aed8643cc38aabe5ad15f4f72113b52af
Author: Julien Rische <jrische at redhat.com>
Date:   Tue Oct 20 18:59:01 2026 +0200

    Fix leak on error in krb5_ktkdb_get_entry()
    
    Decrypt the keyblock into a local variable.  On success, transfer
    memory ownership to entry->key.  On failure, free it in the cleanup
    handler.
    
    [ghudson at mit.edu: minor style edits]
    
    CVE-2026-112317:
    
    krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka
    krb5) 1.2.8 and later does not free decrypted key material when a
    post-decryption check fails, which allows remote attackers to cause a
    denial of service (memory leak in the KDC or kadmind) via requests
    that repeatedly trigger key decryption failures.
    
    (cherry picked from commit 5d79291d7d6732b31a759493a5c0365ed208521a)
    
    ticket: 9268
    version_fixed: 1.22.3

 src/lib/kdb/keytab.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/lib/kdb/keytab.c b/src/lib/kdb/keytab.c
index 346cf962e..0624b6ebd 100644
--- a/src/lib/kdb/keytab.c
+++ b/src/lib/kdb/keytab.c
@@ -122,6 +122,7 @@ krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
     krb5_error_code       kerror = 0;
     krb5_key_data       * key_data;
     krb5_db_entry       * db_entry;
+    krb5_keyblock         kb = { 0 };
     int xrealm_tgt;
     krb5_boolean similar;
 
@@ -163,14 +164,13 @@ krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
         goto error;
 
 
-    kerror = krb5_dbe_decrypt_key_data(context, NULL, key_data,
-                                       &entry->key, NULL);
+    kerror = krb5_dbe_decrypt_key_data(context, NULL, key_data, &kb, NULL);
     if (kerror)
         goto error;
 
     if (enctype > 0) {
-        kerror = krb5_c_enctype_compare(context, enctype,
-                                        entry->key.enctype, &similar);
+        kerror = krb5_c_enctype_compare(context, enctype, kb.enctype,
+                                        &similar);
         if (kerror)
             goto error;
 
@@ -183,14 +183,19 @@ krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
      * Coerce the enctype of the output keyblock in case we got an
      * inexact match on the enctype.
      */
-    entry->key.enctype = enctype;
+    kb.enctype = enctype;
 
     kerror = krb5_copy_principal(context, principal, &entry->principal);
     if (kerror)
         goto error;
 
+    /* Transfer ownership of kb to entry. */
+    entry->key = kb;
+    memset(&kb, 0, sizeof(kb));
+
     /* Close database */
 error:
+    krb5_free_keyblock_contents(context, &kb);
     krb5_db_free_principal(context, db_entry);
     /*    krb5_db_close_database(context); */
     return(kerror);