Description
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MIT krb5
Default version status: unaffected
0 to ≤ 1.22.2affected
pkg:github/krb5/krb5References
- https://github.com/krb5/krb5/pull/1511 ↗
- https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08 ↗
- https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a ↗
- https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112 ↗
- https://github.com/krb5/krb5 ↗
- https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred ↗