]> git.ipfire.org Git - thirdparty/krb5.git/commit
Prevent overflow when calculating ulog block size krb5-1.21
authorZoltan Borbely <Zoltan.Borbely@morganstanley.com>
Tue, 28 Jan 2025 21:39:25 +0000 (16:39 -0500)
committerGreg Hudson <ghudson@mit.edu>
Mon, 4 Aug 2025 21:47:28 +0000 (17:47 -0400)
commitdaa1a9127616c4f50e421038de0b0b93145d74ef
treeaf37461cf7cdeda806aafedb58c74af4bd068715
parent79b244de8be6902a4af2c78e6619a815a1df8722
Prevent overflow when calculating ulog block size

In kdb_log.c:resize(), log an error and fail if the update size is
larger than the largest possible block size (2^16-1).

CVE-2025-24528:

In MIT krb5 release 1.7 and later with incremental propagation
enabled, an authenticated attacker can cause kadmind to write beyond
the end of the mapped region for the iprop log file, likely causing a
process crash.

[ghudson@mit.edu: edited commit message and added CVE description]

(cherry picked from commit 78ceba024b64d49612375be4a12d1c066b0bfbd0)

ticket: 9159
version_fixed: 1.21.4
src/lib/kdb/kdb_log.c