Re: KDC audit plugin potential use-after-free
Alexander Bokovoy via krbdev <[email protected]> Wed, 10 Dec 2025 09:30:42 +0200
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <aTkhovXe/[email protected]> |
T24g0KHRgNC0LCAxMCDRgdC90LUgMjAyNSwgR3JlZyBIdWRzb24gd3JvdGU6Cj5PbiAxMi85LzI1 IDA5OjU4LCDQkNC70LXQutGB0LDQvdC00YAg0JHQsNC60LDQvdC+0LLRgdC60LjQuSB3cm90ZToK Pj5IZWxsbyEgV2hpbGUgd29ya2luZyB3aXRoIGF1ZGl0IHBsdWdpbiBJIGZvdW5kIDIgdXNlLWFm dGVyLWZyZWUgaXNzdWVzCj4KPkkgYW0gYWx3YXlzIGludGVyZXN0ZWQgdG8gaGVhciBhYm91dCBw ZW9wbGUncyB1c2VzIG9mIHRoZSBhdWRpdCBjb2RlLiAKPldlIG5ldmVyIG1hZGUgaXQgcHVibGlj LCBhbmQgSSBjb25zaWRlcmVkIHJlbW92aW5nIGl0IGEgZmV3IHllYXJzIGFnbywgCj5idXQgSSBk ZWNpZGVkIHRvIGxlYXZlIGl0IGluIGFmdGVyIGxlYXJuaW5nIHRoYXQgT3JhY2xlIG1ha2VzIHVz ZSBvZiAKPml0IGluIHRoZWlyIGZvcmsuCgpGcmVlSVBBIHVzZXMgYXVkaXQgcGx1Z2lucyB0byBw cm92aWRlIGNvdW50ZXJzIGZvciBzdWNjZXNzZnVsIGFuZAp1bnN1Y2Nlc3NmdWwgYXV0aGVudGlj YXRpb24gYXR0ZW1wdHMgcGVyIGNsaWVudCBwcmluY2lwYWwuCgpTYW1iYSBBRCB1c2VzIGF1ZGl0 IHBsdWdpbnMgdG8gZG8gdGhlIHNhbWUsIHJlc2V0IG9yIGluY3JlYXNlIGJhZApwYXNzd29yZCBh dXRoZW50aWNhdGlvbiBjb3VudHMgcGVyIGNsaWVudCBwcmluY2lwYWwuCgpXaGlsZSB3ZSBjYW4g cGVyZm9ybSB0aGVzZSB0aHJvdWdoIHRoZSBwb2xpY3kgcGx1Z2luIGFzIHdlbGwsIGF1ZGl0CnBs dWdpbiB1c2FnZSBzZWVtcyBhIGNsZWFyZXIgcGxhY2UuCgpIZWltZGFsIHZlcnNpb24gb2YgU2Ft YmEgQUQgYWxzbyBwZXJmb3JtcyBleHRlbnNpdmUgYXVkaXQgbG9nZ2luZyB3aXRoCnRoZSBkYXRh IGZyb20gdGhlIHJlcXVlc3QsIG5hbWVseSBJUCBhZGRyZXNzZXMsIFBBIHR5cGUsIGFuZCBzb21l CmludGVybmFsIGluZm9ybWF0aW9uIGFib3V0IHRoZSBvYmplY3QgdXNlZCBhcyBhIGNsaWVudCBw cmluY2lwYWwuIFdlCmhhdmVuJ3QgcG9ydGVkIHRoaXMgeWV0IHRvIE1JVCBLZXJiZXJvcyB2ZXJz aW9uIGJ1dCBwbGFuIHRvIGRvIHNvLgoKT24gRnJlZUlQQSBzaWRlIHdlIHdlcmUgcGxhbm5pbmcg dG8gYWRkIHRoZSBzYW1lIGxvZ2dpbmcgZm9yIGRpZmZlcmVudApldmVudHMgYXMgd2VsbC4KCgo+ PjEuIFNvIHJpZ2h0IGJlZm9yZSBwYXNzaW5nIGEgc3RhdGUucmVwbHkgdG8gYSBrYXVfYXNfcmVx KCkgYXVkaXQgZnVuY3Rpb24KPj5pdCBmcmVlcyBzdGF0ZS5yZXBseS5lbmNfcGFydC5jaXBoZXJ0 ZXh0LmRhdGEgc28gZnJvbSB0aGUgcGx1Z2luIHNpZGUgd2UKPj5jYW4gdXNlLWFmdGVyLWZyZWUg KHdoaWNoIGhhcHBlbmVkIHRvIG1lOikpCj4+aHR0cHM6Ly9naXRodWIuY29tL2tyYjUva3JiNS9i bG9iL21hc3Rlci9zcmMva2RjL2RvX2FzX3JlcS5jI0wzMzQKPgo+T3V0IG9mIGN1cmlvc2l0eSwg d2hhdCBpbnRlcmVzdCBkb2VzIGFuIGF1ZGl0IG1vZHVsZSBoYXZlIGluIHRoZSByYXcgCj5jaXBo ZXJ0ZXh0IG9mIHRoZSBlbmNyeXB0ZWQgcGFydCBvZiB0aGUgcmVwbHk/Cj4KPlJlZ2FyZGxlc3Ms IEkgYWdyZWUgdGhhdCB0aGUgY2xlYW51cCBzaG91bGQgYmUgbW92ZWQgbGF0ZXIuICBJdCdzIG5v dCAKPnNhZmUgdG8gbGVhdmUgYSBkYW5nbGluZyBwb2ludGVyIGluc2lkZSBhIHN0cnVjdHVyZSB0 aGF0IGNvbnRpbnVlcyB0byAKPnNlZSB1c2UsIGVzcGVjaWFsbHkgYnkgdGhpcmQtcGFydHkgY29k ZS4KPj4yLiBGb3IgVEdTX1JFUCB0aGVyZSBhbHNvIGFuIGlzc3VlCj4+aHR0cHM6Ly9naXRodWIu Y29tL2tyYjUva3JiNS9ibG9iL21hc3Rlci9zcmMva2RjL2RvX3Rnc19yZXEuYyNMMTA4NyAtIGhl cmUKPj5yZXBseS50aWNrZXQgaXMgYSByZWZlcmVuY2UgdG8gYSB0aWNrZXRfcmVwbHkKPj5odHRw czovL2dpdGh1Yi5jb20va3JiNS9rcmI1L2Jsb2IvbWFzdGVyL3NyYy9rZGMvZG9fdGdzX3JlcS5j I0wxMTI1IC0gaGVyZQo+PnJlcGx5IGlzIHBhc3NlZCB0byBhbiBhdWRpdCBwbHVnaW4gaW4gYSBr YXVfdGdzX3JlcSgpCj4+aHR0cHM6Ly9naXRodWIuY29tL2tyYjUva3JiNS9ibG9iL21hc3Rlci9z cmMva2RjL2RvX3Rnc19yZXEuYyNMMTEyOSAtCj4+Y2xlYW51cCBoYXBwZW5zIGhlcmUKPj4KPj5I b3dldmVyIGZyb20gdGhlIGF1ZGl0IHBsdWdpbiBwZXJzcGVjdGl2ZSB0aWNrZXQuZW5jX3BhcnQg aXMgYWxyZWFkeSBmcmVlJ2QKPgo+SSdtIG5vdCBmb2xsb3dpbmcgdGhpcyBvbmUuICBJdCBzZWVt cyBsaWtlIHRpY2tldF9yZXBseS5lbmNfcGFydCBpcyAKPmNsZWFuZWQgdXAgYWZ0ZXIgdGhlIGxh c3QgdXNlIG9mIHRpY2tldCBhbmQgcmVwbHkuICBhdV9zdGF0ZSBjb250aW51ZXMgCj50byBiZSB1 c2VkIGFmdGVyIHRnc19pc3N1ZV90aWNrZXQoKSByZXR1cm5zLCBidXQgaXQgc2hvdWxkbid0IAo+ cmVmZXJlbmNlIGFueSBkYW5nbGluZyBwb2ludGVycyBhcyBhdV9zdGF0ZS0+cmVwbHkgaXMgbnVs bGVkIGF0IGxpbmUgCj4xMTI1LiAgSSBjYW4ndCBnZXQgbXVjaCBmcm9tIHRoZSBzdGFjayB0cmFj ZXMgaW4gdGhlIHZhbGdyaW5kIG91dHB1dCAKPmR1ZSB0byBsYWNrIG9mIGRlYnVnZ2luZyBzeW1i b2xzLgo+Cj5JcyBpdCBwb3NzaWJsZSB5b3UncmUgc2VlaW5nIHRoaXMgd2l0aCBhbiBvbGRlciB2 ZXJzaW9uIG9mIHRoZSBjb2RlPyAKPjEuMjAgaGFkIGEgc2ltaWxhciBwYXR0ZXJuIHRvIHRoZSBB UyBjb2RlLCB3aGVyZSAKPnRpY2tldF9yZXBseS5lbmNfcGFydC5jaXBoZXJ0ZXh0IGFuZCByZXBs eS5lbmNfcGFydC5jaXBoZXJ0ZXh0IGFyZSAKPmNsZWFuZWQgdXAgYmVmb3JlIGEgY2FsbCB0byBr YXVfdGdzX3JlcSgpIHdpdGggYXVfc3RhdGUtPnJlcGx5IHNldCB0byAKPiZyZXBseS4KPgo+X19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KPmtyYmRldiBtYWls aW5nIGxpc3QgICAgICAgICAgICAga3JiZGV2QG1pdC5lZHUKPmh0dHBzOi8vbWFpbG1hbi5taXQu ZWR1L21haWxtYW4vbGlzdGluZm8va3JiZGV2CgoKCi0tIAovIEFsZXhhbmRlciBCb2tvdm95ClNy LiBQcmluY2lwYWwgU29mdHdhcmUgRW5naW5lZXIKU2VjdXJpdHkgLyBJZGVudGl0eSBNYW5hZ2Vt ZW50IEVuZ2luZWVyaW5nClJlZCBIYXQgTGltaXRlZCwgRmlubGFuZAoKX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Ka3JiZGV2IG1haWxpbmcgbGlzdCAgICAg ICAgICAgICBrcmJkZXZAbWl0LmVkdQpodHRwczovL21haWxtYW4ubWl0LmVkdS9tYWlsbWFuL2xp c3RpbmZvL2tyYmRldgo=