krb5 commit [krb5-1.22]: Fix RPC leak when client switches from RPCSEC_GSS

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/695e8966a6b8750b37f70b0b7d5bc63a221ada07
commit 695e8966a6b8750b37f70b0b7d5bc63a221ada07
Author: Julien Rische <jrische at redhat.com>
Date:   Thu Sep 3 14:18:34 2026 +0200

    Fix RPC leak when client switches from RPCSEC_GSS
    
    svc_do_xprt() currently retains xp_auth across calls for RPCSEC_GSS.
    Consequently, there may be a pre-existing xp_auth value when
    gssrpc__authenticate() begins.  If the client switches to a different
    auth flavor, we must destroy the pre-existing xp_auth value or the new
    auth handler will overwrite it and leak its contents.
    
    [ghudson at mit.edu: edited commit message and comment]
    
    CVE-2026-112320:
    
    The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later
    does not release the previous authentication context when a client
    switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor
    on the same TCP connection.  This allows remote attackers to cause a
    denial of service (memory exhaustion in kadmind) by repeatedly
    establishing and abandoning GSS authentication contexts.
    
    (cherry picked from commit c4288c4a2fd477f60b9390ca5a7db442055e679b)
    
    ticket: 9247
    version_fixed: 1.22.3

 src/lib/rpc/svc_auth.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/lib/rpc/svc_auth.c b/src/lib/rpc/svc_auth.c
index 2df9cf481..d240d2044 100644
--- a/src/lib/rpc/svc_auth.c
+++ b/src/lib/rpc/svc_auth.c
@@ -39,6 +39,8 @@
 
 #include <gssrpc/rpc.h>
 
+extern struct svc_auth_ops svc_auth_gss_ops;
+
 /*
  * Server side authenticators are called from authenticate by
  * using the client auth struct flavor field to index into svcauthsw.
@@ -93,6 +95,16 @@ gssrpc__authenticate(
 	rqst->rq_xprt->xp_verf.oa_length = 0;
 	cred_flavor = rqst->rq_cred.oa_flavor;
 	*no_dispatch = FALSE;
+
+	/* xp_auth is currently retained across calls for RPCSEC_GSS.  If the
+	 * client switched to a different auth flavor, destroy it. */
+	if (rqst->rq_xprt->xp_auth != NULL &&
+	    rqst->rq_xprt->xp_auth->svc_ah_ops == &svc_auth_gss_ops &&
+	    cred_flavor != RPCSEC_GSS) {
+	    SVCAUTH_DESTROY(rqst->rq_xprt->xp_auth);
+	    rqst->rq_xprt->xp_auth = NULL;
+	}
+
 	for (i = 0; i < svcauthnum; i++) {
 	     if (cred_flavor == svcauthsw[i].flavor &&
 		 svcauthsw[i].authenticator != NULL) {