Ticket History #6282: krb5kdc deref uninit memory on the stack on unknown principal (pk-init)

# Thu Dec 04 10:29:48 2008 tsitkova (Zhanna Tsitkova) - Ticket created

Subject:

krb5kdc deref uninit memory on the stack on unknown principal (pk-init)

Download (untitled) / with headers
text/plain 138B

do_as_req.c : in process_as_req memset "reply" to 0.

Vendor's priority - Serious Bug
Vendor's patch - LHA-6397025-dont-deref-stack-memory

# Thu Dec 04 10:29:49 2008 tsitkova (Zhanna Tsitkova) - Ticket 6282 MemberOf ticket 6204.

# Thu Dec 04 13:40:13 2008 tsitkova (Zhanna Tsitkova) - Comments added

Download (untitled) / with headers
text/plain 19B

Including the patch

Download LHA-6397025-dont-deref-stack-memory.patch
text/plain 913B

Crashes in de-ref of reply later when it tries to free memory, this is in the error path from non existant client principal.

diff -Nur -x '*~' -x '*.orig' -x '*.rej' -x '*.pbxbtree' -x '*.pbxindex' -x lha.mode1v3 -x lha.mode2v3 -x lha.pbxuser -x windows -x .DS_Store Kerberos.AEP-6.5fc1.orig/KerberosFramework/Kerberos5/Sources/kdc/do_as_req.c Kerberos.AEP-6.5fc1/KerberosFramework/Kerberos5/Sources/kdc/do_as_req.c
--- Kerberos.AEP-6.5fc1.orig/KerberosFramework/Kerberos5/Sources/kdc/do_as_req.c 2008-11-22 13:06:24.000000000 -0800
+++ Kerberos.AEP-6.5fc1/KerberosFramework/Kerberos5/Sources/kdc/do_as_req.c 2008-11-22 17:37:33.000000000 -0800
@@ -105,7 +105,7 @@
ticket_reply.enc_part.ciphertext.data = 0;
e_data.data = 0;
encrypting_key.contents = 0;
- reply.padata = 0;
+ memset(&reply, 0, sizeof(reply));
session_key.contents = 0;
enc_tkt_reply.authorization_data = NULL;

# Thu Dec 04 15:09:03 2008 tsitkova (Zhanna Tsitkova) - Cc lha (Love Hornquist Astrand) added

# Fri Dec 05 13:16:04 2008 tsitkova (Zhanna Tsitkova) - Given to tsitkova (Zhanna Tsitkova)

# Fri Dec 05 15:18:50 2008 tsitkova (Zhanna Tsitkova) - Status changed from 'new' to 'review'

# Fri Dec 05 15:18:50 2008 tsitkova (Zhanna Tsitkova) - Correspondence added

From:	tsitkova@mit.edu
Subject:	SVN Commit

Download (untitled) / with headers
text/plain 215B

Fix data initialization in process_as_req function.

https://github.com/krb5/krb5/commit/5fb682827a9bf683f0a02db312d6fe3a358167d2
Commit By: tsitkova

Revision: 21291
Changed Files:
U trunk/src/kdc/do_as_req.c

# Thu Jan 29 22:29:04 2009 tlyu (Taylor Yu) - Status changed from 'review' to 'resolved'

# Fri Jan 30 23:08:20 2009 tlyu (Taylor Yu) - Version_Fixed 1.7 added