Bug 2569309

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

AI_ONLY_REPORT
package: krb5-1.21.3-8.el10_0
------
Summary: Pre-auth KDC DoS in PKINIT CMS no-signer path  
(`cms_signeddata_verify` NULL dereference): crafted unauthenticated  
`KRB5_PADATA_PK_AS_REQ` input can dereference a NULL CMS content pointer  
and terminate the KDC process when PKINIT is enabled.
Requirements to exploit: Network reachability to a KDC built from this  
package with PKINIT enabled. The attacker must send an unauthenticated  
AS-REQ containing `KRB5_PADATA_PK_AS_REQ` whose `signedAuthPack` is a CMS  
`SignedData` message with empty `signerInfos` and omitted  
`encapContentInfo.eContent`.
Component affected: `krb5-1.21.3-8.el10_0` KDC PKINIT server-side CMS  
verification in `src/plugins/preauth/pkinit/pkinit_crypto_openssl.c`  
(`cms_signeddata_verify`), reached from  
`src/plugins/preauth/pkinit/pkinit_srv.c` while processing  
`KRB5_PADATA_PK_AS_REQ`.
Version affected: `krb5-1.21.3-8.el10_0`, when built with PKINIT support  
and deployed as a KDC with PKINIT enabled (`pkinit_identity` and  
`pkinit_anchors` configured).
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 7.5 (HIGH)
AV:N - The vulnerable path is reachable by sending a crafted AS-REQ to  
the KDC over the network.
AC:L - Within a PKINIT-enabled deployment, the attack only requires  
malformed CMS `SignedData` input and no special race or timing condition is  
established.
PR:N - The KDC processes the vulnerable path before authentication.
UI:N - No user interaction is required.
S:U - The impact is limited to the KDC service processing the request.
C:N - No confidentiality impact is established by the available evidence.
I:N - No integrity impact is established by the available evidence.
A:H - A successful trigger can terminate the KDC process and deny  
authentication service.
Impact: Moderate. Red Hat guidance treats remote denial of service as  
Important when it is readily reachable, but uses Moderate when exploitation  
depends on a less common or optional configuration. Here, the established  
impact is availability-only, and reachability depends on PKINIT being  
explicitly configured on the KDC rather than the baseline package install.  
Moderate is therefore the better fit for this package.
Embargo: no
Reason: This is a configuration-dependent availability issue with  
straightforward operational mitigation by disabling PKINIT where it is not  
required. The available evidence does not show code execution, privilege  
escalation, or confidentiality/integrity compromise.
Acknowledgement: Aisle Research
Vulnerability Details: The KDC PKINIT server path passes  
attacker-controlled `signedAuthPack` data from `KRB5_PADATA_PK_AS_REQ` into  
`cms_signeddata_verify()` before the client is authenticated:
```c
retval = cms_signeddata_verify(context, plgctx->cryptoctx,
reqctx->cryptoctx, plgctx->idctx,
CMS_SIGN_CLIENT,
plgctx->opts->require_crl_checking,
(unsigned char *)reqp->signedAuthPack.data,
reqp->signedAuthPack.length,
(unsigned char **)&authp_data.data,
&authp_data.length,
(unsigned char **)&krb5_authz.data,
&krb5_authz.length, &is_signed);
```
In the no-signer branch inside `cms_signeddata_verify()`, the code checks  
`octets` but not `*octets` before dereferencing it:
```c
if (((si_sk = CMS_get0_SignerInfos(cms)) == NULL) ||
((si = sk_CMS_SignerInfo_value(si_sk, 0)) == NULL)) {
/* Not actually signed; anonymous case */
if (!is_signed)
goto cleanup;
*is_signed = 0;
/* We cannot use CMS_dataInit because there may be no digest */
octets = CMS_get0_content(cms);
if (octets)
out = BIO_new_mem_buf((*octets)>data, (*octets)>length);
if (out == NULL)
goto cleanup;
}
```
If a crafted CMS `SignedData` message has no signer information and omits  
`encapContentInfo.eContent`, `CMS_get0_content(cms)` may yield a non-NULL  
pointer whose pointee is NULL. The subsequent  
`BIO_new_mem_buf((*octets)>data, (*octets)>length)` dereference can then  
crash the KDC. Based on the available evidence, this is a  
pre-authentication availability issue in the KDC PKINIT path; no  
confidentiality or integrity impact is established.
Steps to reproduce:
1. Configure a test KDC realm with PKINIT enabled by supplying  
`pkinit_identity` and `pkinit_anchors`.
2. Send an unauthenticated AS-REQ containing `KRB5_PADATA_PK_AS_REQ`.
3. Set `signedAuthPack` to CMS `SignedData` with empty `signerInfos` and  
omitted `encapContentInfo.eContent`.
4. Observe KDC process termination during `cms_signeddata_verify()` when  
`BIO_new_mem_buf((*octets)>data, (*octets)>length)` is evaluated.
Mitigation: Where PKINIT is not required, disable KDC PKINIT by ensuring  
`pkinit_identity` and `pkinit_anchors` are not configured. Where PKINIT  
must remain enabled, limit exposure of the KDC to untrusted networks until  
a fix is applied.
Proposed Fix: Add a guard for `*octets` before constructing the BIO in the  
no-signer branch.
```diff
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c  
b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2024,7 +2024,7 @@ cms_signeddata_verify(krb5_context context,
/* We cannot use CMS_dataInit because there may be no digest */
octets = CMS_get0_content(cms);
       if (octets)
+        if (octets && *octets)
              out = BIO_new_mem_buf((*octets)>data, (*octets)>length);
          if (out == NULL)
              goto cleanup;
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use