[krbdev.mit.edu #9007] git commit

[Greg Hudson via RT]

Mon Jul 12 10:38:27 2021: Request 9007 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9007 >



Fix KDC null deref on bad encrypted challenge

The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check
to avoid further processing if the armor key is NULL.  However, this
check is bypassed by a call to k5memdup0() which overwrites retval
with 0 if the allocation succeeds.  If the armor key is NULL, a call
to krb5_c_fx_cf2_simple() will then dereference it, resulting in a
crash.  Add a check before the k5memdup0() call to avoid overwriting
retval.

CVE-2021-36222:

In MIT krb5 releases 1.16 and later, an unauthenticated attacker can
cause a null dereference in the KDC by sending a request containing a
PA-ENCRYPTED-CHALLENGE padata element without using FAST.

[ghudson at mit.edu: trimmed patch; added test case; edited commit
message]

https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
Author: Joseph Sutton <josephsutton at catalyst.net.nz>
Committer: Greg Hudson <ghudson at mit.edu>
Commit: fc98f520caefff2e5ee9a0026fdf5109944b3562
Branch: master
 src/kdc/kdc_preauth_ec.c      |    3 +-
 src/tests/Makefile.in         |    1 +
 src/tests/t_cve-2021-36222.py |   46 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 1 deletions(-)