1*4882a593SmuzhiyunFrom d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
2*4882a593SmuzhiyunFrom: Greg Hudson <ghudson@mit.edu>
3*4882a593SmuzhiyunDate: Tue, 3 Aug 2021 01:15:27 -0400
4*4882a593SmuzhiyunSubject: [PATCH] Fix KDC null deref on TGS inner body null server
5*4882a593Smuzhiyun
6*4882a593SmuzhiyunAfter the KDC decodes a FAST inner body, it does not check for a null
7*4882a593Smuzhiyunserver.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
8*4882a593Smuzhiyunwould typically result in an error from krb5_unparse_name(), but with
9*4882a593Smuzhiyunthe addition of get_local_tgt() it results in a null dereference.  Add
10*4882a593Smuzhiyuna null check.
11*4882a593Smuzhiyun
12*4882a593SmuzhiyunReported by Joseph Sutton of Catalyst.
13*4882a593Smuzhiyun
14*4882a593SmuzhiyunCVE-2021-37750:
15*4882a593Smuzhiyun
16*4882a593SmuzhiyunIn MIT krb5 releases 1.14 and later, an authenticated attacker can
17*4882a593Smuzhiyuncause a null dereference in the KDC by sending a FAST TGS request with
18*4882a593Smuzhiyunno server field.
19*4882a593Smuzhiyun
20*4882a593Smuzhiyunticket: 9008 (new)
21*4882a593Smuzhiyuntags: pullup
22*4882a593Smuzhiyuntarget_version: 1.19-next
23*4882a593Smuzhiyuntarget_version: 1.18-next
24*4882a593Smuzhiyun
25*4882a593Smuzhiyun[Retrieved from:
26*4882a593Smuzhiyunhttps://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49]
27*4882a593SmuzhiyunSigned-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
28*4882a593Smuzhiyun---
29*4882a593Smuzhiyun src/kdc/do_tgs_req.c | 5 +++++
30*4882a593Smuzhiyun 1 file changed, 5 insertions(+)
31*4882a593Smuzhiyun
32*4882a593Smuzhiyundiff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
33*4882a593Smuzhiyunindex 582e497cc9..32dc65fa8e 100644
34*4882a593Smuzhiyun--- a/src/kdc/do_tgs_req.c
35*4882a593Smuzhiyun+++ b/src/kdc/do_tgs_req.c
36*4882a593Smuzhiyun@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
37*4882a593Smuzhiyun         status = "FIND_FAST";
38*4882a593Smuzhiyun         goto cleanup;
39*4882a593Smuzhiyun     }
40*4882a593Smuzhiyun+    if (sprinc == NULL) {
41*4882a593Smuzhiyun+        status = "NULL_SERVER";
42*4882a593Smuzhiyun+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
43*4882a593Smuzhiyun+        goto cleanup;
44*4882a593Smuzhiyun+    }
45*4882a593Smuzhiyun
46*4882a593Smuzhiyun     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
47*4882a593Smuzhiyun                             &local_tgt, &local_tgt_storage, &local_tgt_key);
48