Ticket History #6402: CVE-2009-0845 SPNEGO can dereference a null pointer

I've been testing a Java client using SPNEGO against Apache using
mod_auth_kerb. Apache segfaults with this trace:

#0 0x006ffa25 in spnego_gss_accept_sec_context () from
/usr/lib/libgssapi_krb5.so.2
#1 0x006e3349 in gss_accept_sec_context () from
/usr/lib/libgssapi_krb5.so.2
#2 0x00929769 in kerb_authenticate_user (r=0xb85a1340) at
src/mod_auth_kerb.c:1390
...

The client code has sent slightly invalid ContextFlags for the reqFlags
field in the NegTokenInit (RFC 4178).

This is the sequence which causes the crash. Code fragments are from
1.6.3.

In spnego_gss_accept_sec_context:


if (*context_handle == GSS_C_NO_CONTEXT) {
...
ret = acc_ctx_new(minor_status, input_token,
context_handle, verifier_cred_handle,
&mechtok_in, &mic_in,
&negState, &return_token);
if (ret != GSS_S_COMPLETE)
goto cleanup;

The call to acc_ctx_new fails so the cleanup code is run:

cleanup:
if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC)
{
tmpret = make_spnego_tokenTarg_msg(negState,
sc->internal_mech,
&mechtok_out,
mic_out,
return_token,
output_token);

acc_ctx_new initialises return_token to ERROR_TOKEN_SEND and so the
cleanup code proceeds with the call to make_spnego_tokenTarg_msg.

At this point 'sc' has not been set, so it still NULL and the reference
to sc->internal_mech segfaults.

The acc_ctx_new call fails because get_req_flags rejects the ASN.1 bit
string sent by the client for the reqFlags.

I've tested with 1.7-alpha1 and this fails at the cleanup code with an
assertion failure:

assert(sc != NULL);

This client code could cause any server using Kerberos/SPNEGO to fail.

Richard Evans

"" Arlene Berry " via RT" <rt-comment@krbdev.mit.edu> writes:


[...]

Actually, based on discussion on the krbdev list, I had come up with
this shorter patch. Do you find any particular reasons to prefer one
over the other?

--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1248,7 +1248,8 @@ spnego_gss_accept_sec_context(void *ct,
&negState, &return_token);
}
cleanup:
- if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) {
+ if (return_token == INIT_TOKEN_SEND ||
+ return_token == CONT_TOKEN_SEND) {
tmpret = make_spnego_tokenTarg_msg(negState, sc->internal_mech,
&mechtok_out, mic_out,
return_token,

Committed fix. Please test and review. I accidentally created a new ticket instead of updating
the existing one, but they are now merged.

pull up r22084 from trunk

acc_ctx_new() can return an error condition without establishing a
SPNEGO context structure. This can cause a null pointer dereference
in cleanup code in spnego_gss_accept_sec_context().

https://github.com/krb5/krb5/commit/4af34c6ba769dc50a1dfb4b5ea3f9519b8dd332a
Commit By: tlyu
Revision: 22099
Changed Files:
U branches/krb5-1-7/src/lib/gssapi/spnego/spnego_mech.c

pull up r22173 from trunk

------------------------------------------------------------------------
r22173 | tlyu | 2009-04-07 17:22:13 -0400 (Tue, 07 Apr 2009) | 4 lines
Changed paths:
M /trunk/src/lib/gssapi/spnego/spnego_mech.c

ticket: 6417

Apply revised patch from Apple that ensures that a REJECT token is
sent on error.

https://github.com/krb5/krb5/commit/a0ff28e4ba284d391a2a7e52c35fc8803d8261c6
Commit By: tlyu
Revision: 22222
Changed Files:
U branches/krb5-1-7/src/lib/gssapi/spnego/spnego_mech.c