[krbdev.mit.edu #9007] git commit

Mon Jul 12 10:38:27 2021: Request 9007 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: git commit
       Owner: [email protected]
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9007 >



Fix KDC null deref on bad encrypted challenge

The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check
to avoid further processing if the armor key is NULL.  However, this
check is bypassed by a call to k5memdup0() which overwrites retval
with 0 if the allocation succeeds.  If the armor key is NULL, a call
to krb5_c_fx_cf2_simple() will then dereference it, resulting in a
crash.  Add a check before the k5memdup0() call to avoid overwriting
retval.

CVE-2021-36222:

In MIT krb5 releases 1.16 and later, an unauthenticated attacker can
cause a null dereference in the KDC by sending a request containing a
PA-ENCRYPTED-CHALLENGE padata element without using FAST.

[[email protected]: trimmed patch; added test case; edited commit
message]

https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
Author: Joseph Sutton <[email protected]>
Committer: Greg Hudson <[email protected]>
Commit: fc98f520caefff2e5ee9a0026fdf5109944b3562
Branch: master
 src/kdc/kdc_preauth_ec.c      |    3 +-
 src/tests/Makefile.in         |    1 +
 src/tests/t_cve-2021-36222.py |   46 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 1 deletions(-)