Skip Menu |
 

History Show all quoted text — Show full headers
# Mon Aug 02 23:07:36 2021 Kihong Heo <kihong.heo@gmail.com> - Ticket created
Subject: Potential integer overflows
Date: Tue, 27 Jul 2021 20:35:32 +0900
From: "Kihong Heo" <kihong.heo@gmail.com>
CC: "강우석" <kangwoosukeq@kaist.ac.kr>
To: krb5-bugs@mit.edu
Download (untitled) / with headers
text/plain 597B
Download (untitled) / with headers
text/html 2.1KiB
Dear Kerberos developers,

It seems that there exist several potential integer overflows that can lead buffer overflows. Please find the following description:

In the latest version of Kerberos (1.19.2), 

1. src/kadmin/dbutil/dump.c:660: fscanf reads arbitrarily large integers into u1, u2, …

2. src/kadmin/dbutil/dump.c:671: Call to malloc with the large integer added by one can return a non-null yet invalid address according to the standard.

3. src/kadmin/dbutil/dump.c:685: Call to calloc with the large integer can cause a memory allocation with an overflowed integer 

Best,
Kihong
# Wed Aug 25 18:03:26 2021 ghudson@mit.edu (Greg Hudson) - Taken
# Wed Aug 25 18:03:26 2021 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'resolved'
# Wed Aug 25 18:03:26 2021 ghudson@mit.edu (Greg Hudson) - Correspondence added
Subject: git commit
From: ghudson@mit.edu
Download (untitled) / with headers
text/plain 606B

Add more dump.c bounds checks

Although dump files are privileged inputs, the code to read them
should not admit integer overflows. Add bounds checks for several
fields which are used as allocation lengths or are assigned to
structure fields of smaller size and different signedness. Reported
by Sharwan Ram and Kihong Keo.

https://github.com/krb5/krb5/commit/d15930bec22781473c2eaf72c08a145508b373ba
Author: Greg Hudson <ghudson@mit.edu>
Commit: d15930bec22781473c2eaf72c08a145508b373ba
Branch: master
src/kadmin/dbutil/dump.c | 14 +++++++++++++-
1 files changed, 13 insertions(+), 1 deletions(-)
# Mon Mar 21 21:17:45 2022 ghudson@mit.edu (Greg Hudson) - Version_Fixed 1.20 added