From: Douglas Bagnall Date: Sun, 31 May 2026 00:48:11 +0000 (+1200) Subject: CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob X-Git-Tag: talloc-2.5.0~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7a8fb86ae8cc907f2d26049dbf71c561c40a8de6;p=thirdparty%2Fsamba.git CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob We were making the enc_data_blob 6 bytes too big. Its payload is an ASN.1 structure that knows its own size, so the extra bytes are not usually read by Heimdal, but a crafted packet could force them to be read. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087 Reported-by: Tristan Signed-off-by: Douglas Bagnall Reviewed-by: Stefan Metzmacher --- diff --git a/source4/kdc/kpasswd-service.c b/source4/kdc/kpasswd-service.c index c671eb46d07..0284fb4f133 100644 --- a/source4/kdc/kpasswd-service.c +++ b/source4/kdc/kpasswd-service.c @@ -137,7 +137,7 @@ kdc_code kpasswd_process(struct kdc_server *kdc, ap_req_blob = data_blob_const(&request->data[HEADER_LEN], ap_req_len); - enc_data_len = len - ap_req_len; + enc_data_len = len - (ap_req_len + HEADER_LEN); enc_data_blob = data_blob_const(&request->data[HEADER_LEN + ap_req_len], enc_data_len);