1*4882a593SmuzhiyunFrom d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Greg Hudson <ghudson@mit.edu> 3*4882a593SmuzhiyunDate: Tue, 3 Aug 2021 01:15:27 -0400 4*4882a593SmuzhiyunSubject: [PATCH] Fix KDC null deref on TGS inner body null server 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunAfter the KDC decodes a FAST inner body, it does not check for a null 7*4882a593Smuzhiyunserver. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this 8*4882a593Smuzhiyunwould typically result in an error from krb5_unparse_name(), but with 9*4882a593Smuzhiyunthe addition of get_local_tgt() it results in a null dereference. Add 10*4882a593Smuzhiyuna null check. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunReported by Joseph Sutton of Catalyst. 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunCVE-2021-37750: 15*4882a593Smuzhiyun 16*4882a593SmuzhiyunIn MIT krb5 releases 1.14 and later, an authenticated attacker can 17*4882a593Smuzhiyuncause a null dereference in the KDC by sending a FAST TGS request with 18*4882a593Smuzhiyunno server field. 19*4882a593Smuzhiyun 20*4882a593Smuzhiyunticket: 9008 (new) 21*4882a593Smuzhiyuntags: pullup 22*4882a593Smuzhiyuntarget_version: 1.19-next 23*4882a593Smuzhiyuntarget_version: 1.18-next 24*4882a593Smuzhiyun 25*4882a593Smuzhiyun[Retrieved from: 26*4882a593Smuzhiyunhttps://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49] 27*4882a593SmuzhiyunSigned-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> 28*4882a593Smuzhiyun--- 29*4882a593Smuzhiyun src/kdc/do_tgs_req.c | 5 +++++ 30*4882a593Smuzhiyun 1 file changed, 5 insertions(+) 31*4882a593Smuzhiyun 32*4882a593Smuzhiyundiff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c 33*4882a593Smuzhiyunindex 582e497cc9..32dc65fa8e 100644 34*4882a593Smuzhiyun--- a/src/kdc/do_tgs_req.c 35*4882a593Smuzhiyun+++ b/src/kdc/do_tgs_req.c 36*4882a593Smuzhiyun@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, 37*4882a593Smuzhiyun status = "FIND_FAST"; 38*4882a593Smuzhiyun goto cleanup; 39*4882a593Smuzhiyun } 40*4882a593Smuzhiyun+ if (sprinc == NULL) { 41*4882a593Smuzhiyun+ status = "NULL_SERVER"; 42*4882a593Smuzhiyun+ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; 43*4882a593Smuzhiyun+ goto cleanup; 44*4882a593Smuzhiyun+ } 45*4882a593Smuzhiyun 46*4882a593Smuzhiyun errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, 47*4882a593Smuzhiyun &local_tgt, &local_tgt_storage, &local_tgt_key); 48