Bug 2478440 (CVE-2026-112323)

AI_ONLY_REPORT
package: krb5-1.21.3-8.el10_0
------
Summary: Unauthenticated Memory-Exhaustion DoS in `kadmind` legacy  
`AUTH_GSSAPI` handshake (`svc_auth_gssapi.c`): repeated unauthenticated  
`AUTH_GSSAPI_INIT` failures can allocate per-client state that is retained  
until timeout-based cleanup, allowing remote memory-pressure denial of  
service.
Requirements to exploit: Network reachability to a `kadmind` admin RPC  
endpoint and the ability to send crafted unauthenticated `AUTH_GSSAPI_INIT`  
requests that reach the legacy server-side `AUTH_GSSAPI` handler; no valid  
Kerberos credentials or user interaction are required.
Component affected: `krb5-1.21.3-8.el10_0`,  
`src/lib/rpc/svc_auth_gssapi.c`, `gssrpc__svcauth_gssapi()` legacy  
`AUTH_GSSAPI` handshake path reachable via `kadmind`
Version affected: `krb5-1.21.3-8.el10_0`
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 7.5 (HIGH)
AV:N - The attack is delivered over the network to a reachable `kadmind`  
RPC service.
AC:L - Repeated malformed `AUTH_GSSAPI_INIT` traffic is sufficient; no  
race or unusual precondition is established.
PR:N - No Kerberos credentials or other prior authentication are  
required.
UI:N - No user interaction is needed.
S:U - The impact stays within the authority of the vulnerable service.
C:N - No confidentiality impact is established from the available  
evidence.
I:N - No integrity impact is established from the available evidence.
A:H - Repeated retained allocations can drive sustained memory growth  
and deny service.
Impact: Important. Red Hat classifies flaws that allow remote users to  
cause a denial of service as Important when they can compromise  
availability of resources. Here, the established effect is unauthenticated  
remote memory exhaustion against a reachable `kadmind` service. Critical is  
not supported because the evidence does not show arbitrary code execution  
or broader system compromise, and the demonstrated impact is  
availability-only.
Embargo: no
Reason: The established impact is denial of service on an  
administrative service, and exposure can be materially reduced by  
restricting network access to `kadmind` while a fix is prepared. Private  
coordination is still useful, but the currently established impact does not  
strongly support an extended embargo.
Acknowledgement: Aisle Research
Vulnerability Details: In `gssrpc__svcauth_gssapi()`, an `AUTH_GSSAPI_INIT`  
request with an empty client handle creates new per-client state before  
context establishment. That state is inserted into the global `clients`  
list and given a 15-minute initiation timeout. When context establishment  
fails, the function sends an error response and returns through `error:`  
without destroying the just-created entry.
```c
if (creds.auth_msg && rqst->rq_proc == AUTH_GSSAPI_INIT) {
...
client_data = create_client();
...
}
```
```c
client_data->expiration = time(0) + INITIATION_TIMEOUT;  /* 60*15 */
```
```c
if (call_res.gss_major != GSS_S_COMPLETE &&
call_res.gss_major != GSS_S_CONTINUE_NEEDED) {
...
svc_sendreply(...);
*no_dispatch = TRUE;
ret = AUTH_OK;
goto error;   /* no destroy_client(client_data) */
}
```
Repeated unauthenticated failures therefore accumulate retained  
`svc_auth_gssapi_data` entries until timeout-based cleanup runs. The same  
cleanup gap also affects other post-allocation INIT failure paths that  
return through `error:` after `create_client()` has already succeeded,  
including malformed init arguments or unsupported INIT versions. Based on  
the available evidence, the established impact is denial of service through  
attacker-driven memory growth; no confidentiality or integrity impact is  
established.
Steps to reproduce:
1. Run `kadmind` from this package and ensure the admin RPC service is  
reachable, typically on `749/tcp`.
2. Open one TCP connection to the service.
3. Repeatedly send RPC calls with credential flavor `AUTH_GSSAPI`,  
procedure `AUTH_GSSAPI_INIT`, `auth_msg = TRUE`, an empty `client_handle`,  
and an invalid or malformed init token. Malformed INIT arguments after  
credential parsing also exercise post-allocation failure handling.
4. Observe that failed INIT requests return an error response while also  
yielding a fresh `client_handle`, indicating that new server-side client  
state was created.
5. Continue sending failures at a moderate rate and monitor `kadmind`  
memory usage. Memory rises and remains elevated until the initiation  
timeout expires (about 15 minutes), demonstrating unauthenticated  
memory-pressure denial of service.
Mitigation: Restrict network access to the `kadmind` admin RPC service to  
trusted management hosts, and apply network filtering or rate limiting for  
repeated failed `AUTH_GSSAPI_INIT` traffic where possible. Until a fix is  
available, avoid exposing this administrative interface to untrusted  
networks and monitor `kadmind` for abnormal memory growth.
Proposed Fix: Track whether the current request created a new client entry  
and destroy that entry on all failure exits so partially initialized state  
is not left in the global client list.
```diff
— a/src/lib/rpc/svc_auth_gssapi.c
+++ b/src/lib/rpc/svc_auth_gssapi.c
@@ -170,6 +170,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
enum auth_stat ret;
OM_uint32 ret_flags;
uint32_t seq_num;
+     bool_t created_client = FALSE;
@@ -248,6 +249,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
if (client_data == NULL) {
...
}
+          created_client = TRUE;
} else {
...
}
@@ -461,6 +463,12 @@ enum auth_stat gssrpc__svcauth_gssapi(
gss_release_buffer(&minor_stat, &output_token);
+           if (created_client) {
+                destroy_client(client_data);
+                client_data = NULL;
+                rqst->rq_xprt->xp_auth = &svc_auth_none;
+                created_client = FALSE;
+           }
svc_sendreply(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_res,
(caddr_t) &call_res);
*no_dispatch = TRUE;
@@ -652,6 +660,12 @@ error:
+     if (created_client && client_data != NULL) {
+          destroy_client(client_data);
+          client_data = NULL;
+          rqst->rq_xprt->xp_auth = &svc_auth_none;
+          created_client = FALSE;
+     }
if (creds.client_handle.length != 0) {
...
}
```
------
This report was generated using AI technology. Always review AI-generated  
content prior to use