Bug 2478792 (CVE-2026-112318)

AI_ONLY_REPORT
package: krb5-1.21.3-8.el10_0
------
Summary: DoS in kadmind via NULL dereference in unauthorized policy logging  
(`log_unauth`): an authenticated but unauthorized client can send a crafted  
policy RPC request with a NULL policy name and crash `kadmind` through  
`strlen(NULL)` in the unauthorized logging path.
Requirements to exploit: A running and reachable `kadmind` instance, a  
valid principal that can issue admin RPC requests but lacks  
policy-administration rights, and the ability to send a crafted RPC request  
that encodes the policy name as an XDR nullstring (`size=0`) instead of  
relying on normal `kadmin` CLI validation.
Component affected: `krb5` `kadmind` policy RPC handling in  
`src/kadmin/server/server_stubs.c` (`log_unauth()`,  
`create_policy_2_svc()`, `delete_policy_2_svc()`, `modify_policy_2_svc()`,  
`get_policy_2_svc()`), with NULL policy-name inputs admitted by  
`src/lib/kadm5/kadm_rpc_xdr.c`
Version affected: `krb5-1.21.3-8.el10_0`
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM)
AV:N - The vulnerable path is reachable over the network through  
`kadmind` RPC requests.
AC:L - Exploitation requires only a crafted policy RPC request with a  
NULL XDR string; no race or unusual environmental condition was established.
PR:L - The attacker must authenticate, but does not need  
policy-administration privileges.
UI:N - No user interaction is required.
S:U - The crash affects the same `kadmind` security scope.
C:N - No confidentiality impact was established.
I:N - No integrity impact was established.
A:H - The NULL dereference can terminate `kadmind`, denying  
administrative service until it is restarted.
Impact: Important. This issue allows a remote authenticated attacker to  
cause a denial of service in `kadmind`, which aligns with Red Hat's  
Important category for flaws that allow remote users to impact  
availability. It is not Critical because authentication is required and no  
confidentiality, integrity, or code-execution impact was established.
Embargo: no
Reason: The available evidence supports an authenticated denial of  
service in an administrative daemon, with no demonstrated confidentiality  
or integrity impact and straightforward operational mitigations while a fix  
is prepared.
Acknowledgement: Aisle Research
Vulnerability Details: In `src/kadmin/server/server_stubs.c`,  
`log_unauth()` calls `strlen(target)` without first checking whether  
`target` is `NULL`:
```c
static int
log_unauth(
char *op,
char *target,
gss_buffer_t client,
gss_buffer_t server,
struct svc_req *rqstp)
{
size_t tlen, clen, slen;
char *tdots, *cdots, *sdots;
tlen = strlen(target);
trunc_name(&tlen, &tdots);
clen = client->length;
trunc_name(&clen, &cdots);
slen = server->length;
trunc_name(&slen, &sdots);
/* okay to cast lengths to int because trunc_name limits max value */
return krb5_klog_syslog(LOG_NOTICE,
_("Unauthorized request: %s, %.*s%s, "
"client=%.*s%s, service=%.*s%s, addr=%s"),
op, (int)tlen, target, tdots,
(int)clen, (char *)client->value, cdots,
(int)slen, (char *)server->value, sdots,
client_addr(rqstp->rq_xprt));
}
```
The policy RPC handlers `create_policy_2_svc()`, `delete_policy_2_svc()`,  
`modify_policy_2_svc()`, and `get_policy_2_svc()` pass request-derived  
`arg->rec.policy` or `arg->name` directly into `log_unauth()` when  
authorization fails. Those policy-name fields are decoded with  
`xdr_nullstring()`, and a zero-length XDR string is accepted and decoded to  
`NULL`. As a result, an authenticated caller can send a crafted policy  
request with a NULL policy name, force the unauthorized branch, and reach  
`strlen(NULL)` in the logging path. The success-path logging already  
substitutes `"(null)"` for NULL names, so the crash is specific to  
unauthorized-request logging.
Steps to reproduce:
1. Run `kadmind`.
2. Authenticate as a valid principal that can issue admin RPC requests but  
lacks policy-administration rights.
3. Send one of `CREATE_POLICY`, `DELETE_POLICY`, `MODIFY_POLICY`, or  
`GET_POLICY` with the policy name encoded as an XDR nullstring (`size=0`),  
so the server decodes the field to `NULL`.
4. Ensure the request follows the unauthorized branch.
5. `log_unauth(..., target=NULL, ...)` executes `strlen(NULL)`, causing a  
`SIGSEGV` and denial of `kadmind` service.
Normal `kadmin` client-side checks may reject NULL names, so reproduction  
appears to require a crafted RPC request rather than the stock CLI.
Mitigation: Restrict network access to `kadmind` to trusted administrative  
hosts and limit which principals can authenticate to the admin RPC service.  
Where the service is not required, disabling `kadmind` removes  
reachability. These measures reduce exposure but do not remove the  
vulnerable code path from a reachable instance.
Proposed Fix: A minimal fix is to make `log_unauth()` handle a NULL target  
the same way `log_done()` already does.
```diff
diff --git a/src/kadmin/server/server_stubs.c  
b/src/kadmin/server/server_stubs.c
— a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -384,6 +384,9 @@ log_unauth(
size_t tlen, clen, slen;
char *tdots, *cdots, *sdots;
+    if (target == NULL)
+        target = "(null)";
+
tlen = strlen(target);
trunc_name(&tlen, &tdots);
```
------
This report was generated using AI technology. Always review AI-generated  
content prior to use