Skip Menu |

Subject: git commit

Fix kadm5/gssrpc XDR double free [CVE-2014-9421]

[MITKRB5-SA-2015-001] In auth_gssapi_unwrap_data(), do not free
partial deserialization results upon failure to deserialize. This
responsibility belongs to the callers, svctcp_getargs() and
svcudp_getargs(); doing it in the unwrap function results in freeing
the results twice.

In xdr_krb5_tl_data() and xdr_krb5_principal(), null out the pointers
we are freeing, as other XDR functions such as xdr_bytes() and

(cherry picked from commit a197e92349a4aa2141b5dff12e9dd44c2a2166e3)
Author: Greg Hudson <>
Committer: Tom Yu <>
Commit: 0515f9e7b1d044f68e978f7192cd1e0fc4f5790f
Branch: krb5-1.11
src/lib/kadm5/kadm_rpc_xdr.c | 2 ++
src/lib/rpc/auth_gssapi_misc.c | 1 -
2 files changed, 2 insertions(+), 1 deletions(-)