From: Greg Hudson Date: Tue, 3 Aug 2021 05:15:27 +0000 (-0400) Subject: Fix KDC null deref on TGS inner body null server X-Git-Tag: krb5-1.19.3-final~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f5162aa63fb7652eae2ad74be4c3bdf869c0d1f7;p=thirdparty%2Fkrb5.git Fix KDC null deref on TGS inner body null server After the KDC decodes a FAST inner body, it does not check for a null server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this would typically result in an error from krb5_unparse_name(), but with the addition of get_local_tgt() it results in a null dereference. Add a null check. Reported by Joseph Sutton of Catalyst. CVE-2021-37750: In MIT krb5 releases 1.14 and later, an authenticated attacker can cause a null dereference in the KDC by sending a FAST TGS request with no server field. (cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49) ticket: 9008 version_fixed: 1.19.3 --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 6d244ffd47..39a504ca1d 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, status = "FIND_FAST"; goto cleanup; } + if (sprinc == NULL) { + status = "NULL_SERVER"; + errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; + goto cleanup; + } errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, &local_tgt, &local_tgt_storage, &local_tgt_key);