From 3805a032245f11dc083a601092611808c765c54b Mon Sep 17 00:00:00 2001 From: gaoyusong Date: Wed, 25 Aug 2021 10:49:15 +0800 Subject: [PATCH] Fix CVE-2021-37750 --- backport-CVE-2021-37750.patch | 46 +++++++++++++++++++++++++++++++++++ krb5.spec | 6 ++++- 2 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2021-37750.patch diff --git a/backport-CVE-2021-37750.patch b/backport-CVE-2021-37750.patch new file mode 100644 index 0000000..25b9ff2 --- /dev/null +++ b/backport-CVE-2021-37750.patch @@ -0,0 +1,46 @@ +From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 3 Aug 2021 01:15:27 -0400 +Subject: [PATCH] Fix KDC null deref on TGS inner body null server + +After the KDC decodes a FAST inner body, it does not check for a null +server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this +would typically result in an error from krb5_unparse_name(), but with +the addition of get_local_tgt() it results in a null dereference. Add +a null check. + +Reported by Joseph Sutton of Catalyst. + +CVE-2021-37750: + +In MIT krb5 releases 1.14 and later, an authenticated attacker can +cause a null dereference in the KDC by sending a FAST TGS request with +no server field. + +ticket: 9008 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next +--- + src/kdc/do_tgs_req.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c +index 582e497..32dc65f 100644 +--- a/src/kdc/do_tgs_req.c ++++ b/src/kdc/do_tgs_req.c +@@ -208,6 +208,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, + status = "FIND_FAST"; + goto cleanup; + } ++ if (sprinc == NULL) { ++ status = "NULL_SERVER"; ++ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; ++ goto cleanup; ++ } + + errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, + &local_tgt, &local_tgt_storage, &local_tgt_key); +-- +1.8.3.1 + diff --git a/krb5.spec b/krb5.spec index 0d46019..a3600b5 100644 --- a/krb5.spec +++ b/krb5.spec @@ -3,7 +3,7 @@ Name: krb5 Version: 1.18.2 -Release: 4 +Release: 5 Summary: The Kerberos network authentication protocol License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -28,6 +28,7 @@ Patch5: Remove-3des-support.patch Patch6: FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch7: backport-CVE-2020-28196.patch Patch8: backport-CVE-2021-36222.patch +Patch9: backport-CVE-2021-37750.patch BuildRequires: gettext BuildRequires: gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc @@ -319,6 +320,9 @@ make -C src check || : %{_mandir}/man8/* %changelog +* Wed Aug 25 2021 gaoyusong - 1.18.2-5 +- Fix CVE-2021-37750 + * Wed Jul 21 2021 yixiangzhike - 1.18.2-4 - Fix CVE-2021-36222 -- Gitee