Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package krb5 for openSUSE:Factory checked in at 2021-09-12 20:09:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/krb5 (Old) and /work/SRC/openSUSE:Factory/.krb5.new.1899 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "krb5" Sun Sep 12 20:09:33 2021 rev:156 rq:917690 version:1.19.2 Changes: -------- --- /work/SRC/openSUSE:Factory/krb5/krb5-mini.changes 2021-08-18 08:55:09.795024906 +0200 +++ /work/SRC/openSUSE:Factory/.krb5.new.1899/krb5-mini.changes 2021-09-12 20:09:33.668085170 +0200 @@ -1,0 +2,8 @@ +Mon Aug 30 12:45:25 UTC 2021 - Samuel Cabrero <[email protected]> + +- Fix KDC null pointer dereference via a FAST inner body that + lacks a server field; (CVE-2021-37750); (bsc#1189929); +- Added patches: + * 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch + +------------------------------------------------------------------- krb5.changes: same change New: ---- 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ krb5-mini.spec ++++++ --- /var/tmp/diff_new_pack.06X065/_old 2021-09-12 20:09:34.580086202 +0200 +++ /var/tmp/diff_new_pack.06X065/_new 2021-09-12 20:09:34.584086206 +0200 @@ -44,6 +44,7 @@ Patch6: 0006-krb5-1.12-api.patch Patch7: 0007-SELinux-integration.patch Patch8: 0008-krb5-1.9-debuginfo.patch +Patch9: 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch BuildRequires: autoconf BuildRequires: bison BuildRequires: keyutils ++++++ krb5.spec ++++++ --- /var/tmp/diff_new_pack.06X065/_old 2021-09-12 20:09:34.608086233 +0200 +++ /var/tmp/diff_new_pack.06X065/_new 2021-09-12 20:09:34.612086239 +0200 @@ -42,6 +42,7 @@ Patch6: 0006-krb5-1.12-api.patch Patch7: 0007-SELinux-integration.patch Patch8: 0008-krb5-1.9-debuginfo.patch +Patch9: 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch BuildRequires: autoconf BuildRequires: bison BuildRequires: cyrus-sasl-devel ++++++ 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch ++++++ >From 74444508aa249bf8d34865e25413c6432e7583b4 Mon Sep 17 00:00:00 2001 From: Greg Hudson <[email protected]> Date: Tue, 3 Aug 2021 01:15:27 -0400 Subject: [PATCH] Fix KDC null deref on TGS inner body null server After the KDC decodes a FAST inner body, it does not check for a null server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this would typically result in an error from krb5_unparse_name(), but with the addition of get_local_tgt() it results in a null dereference. Add a null check. Reported by Joseph Sutton of Catalyst. CVE-2021-37750: In MIT krb5 releases 1.14 and later, an authenticated attacker can cause a null dereference in the KDC by sending a FAST TGS request with no server field. ticket: 9008 (new) tags: pullup target_version: 1.19-next target_version: 1.18-next (cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49) --- src/kdc/do_tgs_req.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 6d244ffd4..39a504ca1 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, status = "FIND_FAST"; goto cleanup; } + if (sprinc == NULL) { + status = "NULL_SERVER"; + errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; + goto cleanup; + } errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, &local_tgt, &local_tgt_storage, &local_tgt_key); -- 2.33.0
