Bug 2479403 (CVE-2026-112315)

AI_ONLY_REPORT
package: krb5-1.21.3-8.el10_0
------
Summary: Pre-auth Memory Leak in RPCSEC_GSS Credential Decode Failure Path  
(`gssrpc__svcauth_gss`): malformed unauthenticated RPCSEC_GSS credentials  
can leak `gc_ctx` allocations on decode failure, allowing gradual  
memory-exhaustion denial of service.
Requirements to exploit: Network reachability to a service from  
`krb5-1.21.3-8.el10_0` that parses `RPCSEC_GSS` credentials before  
authentication, plus the ability to send repeated malformed RPC requests  
with a truncated embedded `gc_ctx` buffer. No prior authentication or user  
interaction is required.
Component affected: `krb5-1.21.3-8.el10_0`, `src/lib/rpc/svc_auth_gss.c`,  
`gssrpc__svcauth_gss` (with the leaking allocation originating from  
`xdr_rpc_gss_cred()` via `xdr_rpc_gss_buf()` / `xdr_bytes()`)
Version affected: `krb5-1.21.3-8.el10_0`
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - 5.3 (MEDIUM)
AV:N - The affected code parses attacker-controlled RPC credential data  
over the network.
AC:L - The failure condition is induced with a malformed but simple  
truncated credential blob.
PR:N - The leak occurs in the pre-authentication credential decode path.
UI:N - No user interaction is required.
S:U - The impact is limited to the targeted service process.
C:N - The available evidence does not show unauthorized data disclosure.
I:N - The available evidence does not show data modification or code  
execution.
A:L - Each request leaks only a bounded amount of memory  
(`MAX_AUTH_BYTES`), but repeated requests can accumulate enough loss to  
degrade or eventually exhaust the service.
Impact: Important. Red Hat classifies flaws that allow remote users to  
cause denial of service as Important, and this issue is reachable before  
authentication where an exposed RPCSEC_GSS service path exists. The  
practical effect established here is gradual availability loss rather than  
immediate crash or system compromise, because the leak is bounded per  
request and requires repetition.
Embargo: no
Reason: The demonstrated impact is availability-only, the leak is  
gradual, and straightforward mitigations exist by restricting network  
access to affected RPCSEC_GSS-enabled administrative services while a fix  
is prepared.
Acknowledgement: Aisle Research
Vulnerability Details: In `gssrpc__svcauth_gss()`, a decode failure returns  
immediately instead of using the existing `freegc:` cleanup path:
```c
if (!xdr_rpc_gss_cred(&xdrs, gc)) {
log_debug("xdr_rpc_gss_cred() failed");
XDR_DESTROY(&xdrs);
return (AUTH_BADCRED);
}
...
freegc:
xdr_free((xdrproc_t)xdr_rpc_gss_cred, gc);
log_debug("returning %d from svcauth_gss()", retstat);
return (retstat);
```
The decoded `gc_ctx` field is populated through `xdr_rpc_gss_buf()` and  
`xdr_bytes()`. On `XDR_DECODE`, `xdr_bytes()` allocates the buffer before  
it attempts to read the declared opaque bytes. If the embedded RPCSEC_GSS  
credential advertises a non-zero `gc_ctx` length but truncates the  
remaining credential bytes, the opaque read can fail after allocation.  
Because the function returns before `xdr_free((xdrproc_t)xdr_rpc_gss_cred,  
gc)` is reached, that nested allocation is not released on the failing  
request.
The available material further supports that this parser is selected from  
the server authentication dispatch when `cb_cred.oa_flavor` is  
`RPCSEC_GSS`. The resulting leak is bounded per request by the  
credential-size checks, but repeated malformed unauthenticated requests can  
cause monotonic memory growth over time. The evidence supports this for  
deployments that expose an RPCSEC_GSS-enabled service path, including  
in-tree administrative paths such as kadmind or iprop; it does not  
establish that every deployment of the SRPM exposes those paths.
Steps to reproduce:
1. Reach a server path built from `krb5-1.21.3-8.el10_0` that accepts  
`RPCSEC_GSS` credentials before authentication.
2. Send an RPC call with `cb_cred.oa_flavor = RPCSEC_GSS`.
3. Keep the outer credential blob within the accepted `MAX_AUTH_BYTES`  
limit so decoding proceeds into the embedded RPCSEC_GSS credential.
4. Inside the embedded credential, set `gc_ctx` to a non-zero declared  
length but truncate the remaining bytes so allocation occurs and the  
subsequent opaque-byte read fails.
5. Observe an authentication failure associated with `AUTH_BADCRED` while  
the service retains the allocation from the failed decode path.
6. Repeat the malformed request and monitor service memory growth over time.
Mitigation: Restrict network access to RPCSEC_GSS-enabled administrative  
services to trusted clients until a fix is available. Where feasible, do  
not expose kadmind/iprop-related RPC endpoints to untrusted networks, and  
apply rate limiting or connection controls to reduce the effect of repeated  
malformed requests.
Proposed Fix: Route the decode-failure path through the existing `freegc:`  
cleanup so partially decoded RPCSEC_GSS credentials are always released.
```diff
diff --git a/krb5-1.21.3/src/lib/rpc/svc_auth_gss.c  
b/krb5-1.21.3/src/lib/rpc/svc_auth_gss.c
index <old>..<new> 100644
— a/krb5-1.21.3/src/lib/rpc/svc_auth_gss.c
+++ b/krb5-1.21.3/src/lib/rpc/svc_auth_gss.c
@@ -434,10 +434,12 @@ gssrpc__svcauth_gss(struct svc_req *rqst, struct  
rpc_msg *msg,
rqst->rq_cred.oa_length, XDR_DECODE);
log_debug("xdrmem_create() returned");
if (!xdr_rpc_gss_cred(&xdrs, gc)) {
log_debug("xdr_rpc_gss_cred() failed");
XDR_DESTROY(&xdrs);
              return (AUTH_BADCRED);
+               retstat = AUTH_BADCRED;
+               goto freegc;
         }
         XDR_DESTROY(&xdrs);
```


An equivalent fix is to call `xdr_free((xdrproc_t)xdr_rpc_gss_cred, gc)`  
immediately before returning `AUTH_BADCRED`.
------
This report was generated using AI technology. Always review AI-generated  
content prior to use