[packages/krb5] Fix CVE-2026-40355, CVE-2026-40356, CVE-2026-11850, svc_auth_gssapi read overrun
arekm
arekm at pld-linux.org
Fri Aug 7 09:16:24 CEST 2026
commit 801187a0d5c4e532739966a8f144220a5fc17cde
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Fri Aug 7 09:07:34 2026 +0200
Fix CVE-2026-40355, CVE-2026-40356, CVE-2026-11850, svc_auth_gssapi read overrun
CVE-2026-11850.patch | 34 +++++++++++++++++++++
CVE-2026-40355.patch | 61 ++++++++++++++++++++++++++++++++++++++
krb5-svc_auth_gssapi-overrun.patch | 34 +++++++++++++++++++++
krb5.spec | 10 ++++++-
4 files changed, 138 insertions(+), 1 deletion(-)
---
diff --git a/krb5.spec b/krb5.spec
index 799a751..6a47d4c 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -17,7 +17,7 @@ Summary: Kerberos V5 System
Summary(pl.UTF-8): System Kerberos V5
Name: krb5
Version: 1.22.2
-Release: 0.1
+Release: 0.2
License: MIT
Group: Networking
Source0: https://web.mit.edu/kerberos/dist/krb5/1.22/%{name}-%{version}.tar.gz
@@ -49,6 +49,11 @@ Patch7: %{name}-dns.patch
Patch8: %{name}-enospc.patch
Patch9: %{name}-tests.patch
Patch10: %{name}-keyring-test.patch
+# fixes from krb5-1.22 branch, unreleased (1.22.3)
+# CVE-2026-40355 patch also fixes CVE-2026-40356
+Patch11: CVE-2026-40355.patch
+Patch12: CVE-2026-11850.patch
+Patch13: %{name}-svc_auth_gssapi-overrun.patch
URL: https://web.mit.edu/kerberos/www/
BuildRequires: /bin/csh
%{?with_audit:BuildRequires: audit-libs-devel}
@@ -401,6 +406,9 @@ Dokumentacja systemu MIT Kerberos V5 w formacie HTML.
%patch -P8 -p1
%patch -P9 -p1
%patch -P10 -p1
+%patch -P11 -p1
+%patch -P12 -p1
+%patch -P13 -p1
%build
cd src
diff --git a/CVE-2026-11850.patch b/CVE-2026-11850.patch
new file mode 100644
index 0000000..1eec6f8
--- /dev/null
+++ b/CVE-2026-11850.patch
@@ -0,0 +1,34 @@
+From 974a8875767a2f375669f84b176c7d98a7c85a20 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebasti=C3=A1n=20Alba?= <sebasjosue84 at gmail.com>
+Date: Wed, 8 Apr 2026 18:32:25 -0400
+Subject: [PATCH] Prevent read overrun in libkdb_ldap
+
+In berval2tl_data(), reject inputs of length less than 2 to prevent an
+integer underflow and subsequent read overrun. (The security impact
+is negligible as the attacker would have to control the KDB LDAP
+server.)
+
+[ghudson at mit.edu: wrote commit message]
+
+(cherry picked from commit 2a5fd83d4436583f2ddc0e193269a4d800ee45c4)
+
+ticket: 9206
+version_fixed: 1.22.3
+---
+ src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index ae4e03f8cf..525e8d0277 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -80,6 +80,9 @@ getstringtime(krb5_timestamp);
+ krb5_error_code
+ berval2tl_data(struct berval *in, krb5_tl_data **out)
+ {
++ if (in->bv_len < 2)
++ return EINVAL;
++
+ *out = (krb5_tl_data *) malloc (sizeof (krb5_tl_data));
+ if (*out == NULL)
+ return ENOMEM;
diff --git a/CVE-2026-40355.patch b/CVE-2026-40355.patch
new file mode 100644
index 0000000..ef06298
--- /dev/null
+++ b/CVE-2026-40355.patch
@@ -0,0 +1,61 @@
+From acea6182e46fff3d1d64a3172cdff307b07ca441 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson at mit.edu>
+Date: Wed, 8 Apr 2026 17:57:59 -0400
+Subject: [PATCH] Fix two NegoEx parsing vulnerabilities
+
+In parse_nego_message(), check the result of the second call to
+vector_base() before dereferencing it. In parse_message(), check for
+a short header_len to prevent an integer underflow when calculating
+the remaining message length.
+
+Reported by Cem Onat Karagun.
+
+CVE-2026-40355:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a null pointer dereference, causing the process to terminate.
+
+CVE-2026-40356:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a read overrun of up to 52 bytes, possibly causing the process
+to terminate. Exfiltration of the bytes read does not appear
+possible.
+
+(cherry picked from commit 2e75f0d9362fb979f5fc92829431a590a130929f)
+
+ticket: 9205
+version_fixed: 1.22.3
+---
+ src/lib/gssapi/spnego/negoex_util.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/gssapi/spnego/negoex_util.c b/src/lib/gssapi/spnego/negoex_util.c
+index edc5462e844..a65238e5730 100644
+--- a/src/lib/gssapi/spnego/negoex_util.c
++++ b/src/lib/gssapi/spnego/negoex_util.c
+@@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in,
+ offset = k5_input_get_uint32_le(in);
+ count = k5_input_get_uint16_le(in);
+ p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len);
++ if (p == NULL) {
++ *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
++ return GSS_S_DEFECTIVE_TOKEN;
++ }
+ for (i = 0; i < count; i++) {
+ extension_type = load_32_le(p + i * EXTENSION_LENGTH);
+ if (extension_type & EXTENSION_FLAG_CRITICAL) {
+@@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in,
+ msg_len = k5_input_get_uint32_le(in);
+ conv_id = k5_input_get_bytes(in, GUID_LENGTH);
+
+- if (in->status || msg_len > token_remaining || header_len > msg_len) {
++ if (in->status || msg_len > token_remaining ||
++ header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) {
+ *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
+ return GSS_S_DEFECTIVE_TOKEN;
+ }
diff --git a/krb5-svc_auth_gssapi-overrun.patch b/krb5-svc_auth_gssapi-overrun.patch
new file mode 100644
index 0000000..1a26b1a
--- /dev/null
+++ b/krb5-svc_auth_gssapi-overrun.patch
@@ -0,0 +1,34 @@
+From 9d9487956766f74485a32de6ad0f628f4251a6f0 Mon Sep 17 00:00:00 2001
+From: Rahul Hoysala <rahulhoysala07 at gmail.com>
+Date: Sat, 21 Mar 2026 12:29:44 +0530
+Subject: [PATCH] Prevent read overrun in svc_auth_gssapi
+
+In gssrpc__svcauth_gssapi(), check that the client handle length is at
+least 4, to prevent an out-of-bounds read by get_client().
+
+[ghudson at mit.edu: combined length<4 check with length==0 check;
+rewrote commit message]
+
+(cherry picked from commit f8a0bee0a54ba0d96804631a3261ecd233051863)
+
+ticket: 9201
+version_fixed: 1.22.3
+---
+ src/lib/rpc/svc_auth_gssapi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c
+index 267c1545bdf..4be1e04331e 100644
+--- a/src/lib/rpc/svc_auth_gssapi.c
++++ b/src/lib/rpc/svc_auth_gssapi.c
+@@ -253,8 +253,8 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ goto error;
+ }
+ } else {
+- if (creds.client_handle.length == 0) {
+- PRINTF(("svcauth_gssapi: expected non-empty creds\n"));
++ if (creds.client_handle.length < 4) {
++ PRINTF(("svcauth_gssapi: expected creds length at least 4\n"));
+ LOG_MISCERR("protocol error in client credentials");
+ ret = AUTH_FAILED;
+ goto error;
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/krb5.git/commitdiff/b3aaadc16bf392fbfd62286726b6011cd8f7255a
More information about the pld-cvs-commit
mailing list