Bug 1267176 - Memory leak / possible DoS with krb auth. [rhel 7.2]
Summary: Memory leak / possible DoS with krb auth. [rhel 7.2]
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.1
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: 7.2
Assignee: SSSD Maintainers
QA Contact: Kaushik Banerjee
Depends On:
Blocks: CVE-2015-5292
TreeView+ depends on / blocked
Reported: 2015-09-29 08:50 UTC by Anthony Russell
Modified: 2020-05-02 18:11 UTC (History)
18 users (show)

Fixed In Version: sssd-1.13.0-38.el7
Doc Type: Bug Fix
Doc Text:
Applications performing Kerberos authentication previously increased the memory footprint of the Kerberos plug-in that parses the Privilege Attribute Certificate (PAC) information. The plug-in has been updated to free the memory it allocates, thus fixing this bug.
Clone Of: 1266404
Last Closed: 2015-11-19 11:40:48 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
FedoraHosted SSSD 2803 0 None None None Never
Github SSSD sssd issues 3844 0 None None None 2020-05-02 18:11:10 UTC
Red Hat Product Errata RHSA-2015:2355 0 normal SHIPPED_LIVE Low: sssd security, bug fix, and enhancement update 2015-11-19 10:27:42 UTC

Description Anthony Russell 2015-09-29 08:50:51 UTC
Description of problem:

Back port request for upstream fix at https://fedorahosted.org/sssd/ticket/2803#comment:3 to RHEL7

From there:
We believe there is a memory leak in the sssd_pac_plugin (sssd_pac_plugin.so library) distributed with the sssd_client package. 

The issue was revealed in one of our daemons using kerberos 5 authentication and leaking gigabytes of memory after several days (1GB/day on average for 10 authentications per second). Putting it in valgrind, we found the following :

==27734== 1,344 (+1,344) (32 (+32) direct, 1,312 (+1,312) indirect) bytes in 1 (+1) blocks are definitely lost in loss record 484 of 540
==27734==    at 0x4A06A2E: malloc (vg_replace_malloc.c:270)
==27734==    by 0x50D96C2: krb5_pac_init (pac.c:231)
==27734==    by 0x50D9D2D: krb5_pac_parse (pac.c:332)
==27734==    by 0x19C70CA6: sssdpac_verify (sssd_pac.c:144)
==27734==    by 0x50C1E52: krb5int_authdata_verify (authdata.c:617)
==27734==    by 0x50E19CF: rd_req_decoded_opt (rd_req_dec.c:437)
==27734==    by 0x50E1A59: krb5_rd_req_decoded (rd_req_dec.c:599)
==27734==    by 0x50E0A88: krb5_rd_req (rd_req.c:87)
==27734==    by 0x4E49770: kg_accept_krb5 (accept_sec_context.c:643)
==27734==    by 0x4E4B0A9: krb5_gss_accept_sec_context_ext (accept_sec_context.c:1338)
==27734==    by 0x4E4B208: krb5_gss_accept_sec_context (accept_sec_context.c:1367)
==27734==    by 0x4E3AC22: gss_accept_sec_context (g_accept_sec_context.c:203)
==27734==    by 0x19A6C728: Csec_server_establish_context_ext_KRB5 (Csec_plugin_GSS.c:482)
==27734==    by 0x834EBC2: Csec_server_establish_context_ext_caller (Csec_plugin.h:129)
==27734==    by 0x835416A: Csec_server_establish_context_ext (Csec_api.c:277)
==27734==    by 0x8353FE4: Csec_server_establishContext (Csec_api.c:218)
==27734==    by 0x406407: doit (Cns_main.c:747)
==27734==    by 0x8129420: _Cpool_starter (Cpool.c:377)
==27734==    by 0x8124914: _Cthread_start_pthread (Cthread.c:209)
==27734==    by 0x30CCA07A50: start_thread (pthread_create.c:301)
==27734==    by 0x30CC6E89AC: clone (clone.S:115)

The study of the corresponding code clearly shows a genuine bug introduced in sssd_client via commit 92af6f25 in May 2013. Here are the details :

    in krb5int_authdata_verify (authdata.c:617), so krb5 code, the plugin is called :

       code = (*module->ftable->verify)(kcontext,

    this calls sssdpac_verify (sssd_pac.c:144) and the code looks like this (I've dropped irrelevant lines and commented) :

         krb5_pac pac;   // krb5_pac is actually a pointer type
         kerr = krb5_pac_parse(kcontext, sssdctx->data.data,    // allocation of the pac pointer from input data
                               sssdctx->data.length, &pac);
         kerr = krb5_pac_verify(kcontext, pac,                  // verification of the pac content
                                req->ticket->enc_part2->client, key, NULL);
         ...           // no reference to pac
         return 0;     // memory leak!

    I did check the code of parse and verify, and they are doing what you expect, so no hidden ref count or anything special. 

So according to all this, the patch to the leak is the following :

diff --git a/src/sss_client/sssd_pac.c b/src/sss_client/sssd_pac.c
index 1939f61..1d1fe8a 100644
--- a/src/sss_client/sssd_pac.c
+++ b/src/sss_client/sssd_pac.c
@@ -150,6 +150,10 @@ static krb5_error_code sssdpac_verify(krb5_context kcontext,
     kerr = krb5_pac_verify(kcontext, pac,
                            req->ticket->enc_part2->client, key, NULL);
+    // deallocate pac - fixes memory leak reported in bug ...
+    krb5_pac_free(kcontext, pac);
+    pac = NULL;
+    // check result of the verification
     if (kerr != 0) {
         /* The krb5 documentation says:
          * A checksum mismatch can occur if the PAC was copied from a

Version-Release number of selected component (if applicable):

This has been found on a machine running the following versions of kerberos and sssd :

Comment 1 Jakub Hrozek 2015-09-30 12:38:14 UTC
Upstream ticket:

Comment 2 Jakub Hrozek 2015-09-30 12:53:56 UTC
 master: b4c44ebb8997d3debb33607c123ccfd9926e0cba

Comment 6 Steeve Goveas 2015-10-12 16:31:47 UTC
Verified sanity only in sssd version

[root@ipaclient02 ~]# rpm -q sssd

[root@ipaclient02 ~]# service sssd stop; rm -f /var/lib/sss/{mc,db}/*; service sssd start
Redirecting to /bin/systemctl stop  sssd.service
Redirecting to /bin/systemctl start  sssd.service

[root@ipaclient02 ~]# klist
klist: Credentials cache keyring 'persistent:0:0' not found

[root@ipaclient02 ~]# echo Secret123 | kinit aduser
Password for aduser: 

[root@ipaclient02 ~]# ssh -vvv -K -l aduser `hostname`
OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 ipaclient02.labs02.test
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: permanently_drop_suid: 0
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 5 setting O_NONBLOCK
debug2: fd 4 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "ipaclient02.labs02.test" from file "/root/.ssh/known_hosts"
debug3: Ignored env _
debug3: Ignored env OLDPWD
debug2: channel 0: request shell confirm 1
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0
Last login: Mon Oct 12 21:54:25 2015 from ipaclient02.labs01.test
Could not chdir to home directory /home/adlabs.com/aduser: No such file or directory

-sh-4.2$ id
uid=1436801930(aduser) gid=1436801930(aduser) groups=1436801930(aduser),1436800513(domain users) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Comment 7 errata-xmlrpc 2015-11-19 11:40:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.