From 83ed75feba32e46f736fcce0d96a0445f29b96c2 Mon Sep 17 00:00:00 2001

From: Greg Hudson <ghudson@mit.edu>

Date: Fri, 8 Jan 2016 13:16:54 -0500

Subject: [PATCH 3/3] Fix leaks in kadmin server stubs [CVE-2015-8631]

In each kadmind server stub, initialize the client_name and

server_name variables, and release them in the cleanup handler.  Many

of the stubs will otherwise leak the client and server name if

krb5_unparse_name() fails.  Also make sure to free the prime_arg

variables in rename_principal_2_svc(), or we can leak the first one if

unparsing the second one fails.  Discovered by Simo Sorce.

CVE-2015-8631:

In all versions of MIT krb5, an authenticated attacker can cause

kadmind to leak memory by supplying a null principal name in a request

which uses one.  Repeating these requests will eventually cause

kadmind to exhaust all available memory.

    CVSSv2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C

ticket: 8343 (new)

target_version: 1.14-next

target_version: 1.13-next

tags: pullup

---

 src/kadmin/server/server_stubs.c | 151 ++++++++++++++++++++-------------------

 1 file changed, 77 insertions(+), 74 deletions(-)

diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c

index 1879dc6..6ac797e 100644

--- a/src/kadmin/server/server_stubs.c

+++ b/src/kadmin/server/server_stubs.c

@@ -334,7 +334,8 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret          ret;

     char                        *prime_arg;

-    gss_buffer_desc             client_name, service_name;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_server_handle_t       handle;

     restriction_t               *rp;

@@ -382,10 +383,10 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

-    gss_release_buffer(&minor_stat, &client_name);

-    gss_release_buffer(&minor_stat, &service_name);

 exit_func:

+    gss_release_buffer(&minor_stat, &client_name);

+    gss_release_buffer(&minor_stat, &service_name);

     free_server_handle(handle);

     return &ret;

 }

@@ -395,7 +396,8 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret          ret;

     char                        *prime_arg;

-    gss_buffer_desc             client_name, service_name;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_server_handle_t       handle;

     restriction_t               *rp;

@@ -444,10 +446,10 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

-    gss_release_buffer(&minor_stat, &client_name);

-    gss_release_buffer(&minor_stat, &service_name);

 exit_func:

+    gss_release_buffer(&minor_stat, &client_name);

+    gss_release_buffer(&minor_stat, &service_name);

     free_server_handle(handle);

     return &ret;

 }

@@ -457,8 +459,8 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -501,10 +503,10 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)

     }

     free(prime_arg);

-    gss_release_buffer(&minor_stat, &client_name);

-    gss_release_buffer(&minor_stat, &service_name);

 exit_func:

+    gss_release_buffer(&minor_stat, &client_name);

+    gss_release_buffer(&minor_stat, &service_name);

     free_server_handle(handle);

     return &ret;

 }

@@ -514,8 +516,8 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     restriction_t                   *rp;

@@ -559,9 +561,9 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -570,10 +572,9 @@ generic_ret *

 rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret          ret;

-    char                        *prime_arg1,

-        *prime_arg2;

-    gss_buffer_desc             client_name,

-        service_name;

+    char                        *prime_arg1 = NULL, *prime_arg2 = NULL;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_server_handle_t       handle;

     restriction_t               *rp;

@@ -655,11 +656,11 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

+exit_func:

     free(prime_arg1);

     free(prime_arg2);

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -669,8 +670,8 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)

 {

     static gprinc_ret               ret;

     char                            *prime_arg, *funcname;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -719,9 +720,9 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -731,8 +732,8 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)

 {

     static gprincs_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -777,9 +778,9 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -789,8 +790,8 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -840,9 +841,9 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -852,8 +853,8 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -909,9 +910,9 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -921,8 +922,8 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -969,9 +970,9 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -981,8 +982,8 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1029,9 +1030,9 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1041,8 +1042,8 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1092,9 +1093,9 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1106,8 +1107,8 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)

     krb5_keyblock               *k;

     int                         nkeys;

     char                        *prime_arg, *funcname;

-    gss_buffer_desc             client_name,

-        service_name;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_server_handle_t       handle;

     const char                  *errmsg = NULL;

@@ -1164,9 +1165,9 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1178,8 +1179,8 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)

     krb5_keyblock               *k;

     int                         nkeys;

     char                        *prime_arg, *funcname;

-    gss_buffer_desc             client_name,

-        service_name;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_server_handle_t       handle;

     const char                  *errmsg = NULL;

@@ -1241,9 +1242,9 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1253,8 +1254,8 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1295,9 +1296,9 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)

         if (errmsg != NULL)

             krb5_free_error_message(handle->context, errmsg);

     }

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1307,8 +1308,8 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1347,9 +1348,9 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)

         if (errmsg != NULL)

             krb5_free_error_message(handle->context, errmsg);

     }

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1359,8 +1360,8 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1400,9 +1401,9 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)

         if (errmsg != NULL)

             krb5_free_error_message(handle->context, errmsg);

     }

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1413,8 +1414,8 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)

     static gpol_ret             ret;

     kadm5_ret_t         ret2;

     char                        *prime_arg, *funcname;

-    gss_buffer_desc             client_name,

-        service_name;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_principal_ent_rec     caller_ent;

     kadm5_server_handle_t       handle;

@@ -1475,9 +1476,9 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)

         log_unauth(funcname, prime_arg,

                    &client_name, &service_name, rqstp);

     }

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

@@ -1488,8 +1489,8 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)

 {

     static gpols_ret                ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1531,9 +1532,9 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)

         if (errmsg != NULL)

             krb5_free_error_message(handle->context, errmsg);

     }

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1541,7 +1542,8 @@ exit_func:

 getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)

 {

     static getprivs_ret            ret;

-    gss_buffer_desc                client_name, service_name;

+    gss_buffer_desc                client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                      minor_stat;

     kadm5_server_handle_t          handle;

     const char                     *errmsg = NULL;

@@ -1571,9 +1573,9 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)

     if (errmsg != NULL)

         krb5_free_error_message(handle->context, errmsg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1583,7 +1585,8 @@ purgekeys_2_svc(purgekeys_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret          ret;

     char                        *prime_arg, *funcname;

-    gss_buffer_desc             client_name, service_name;

+    gss_buffer_desc             client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc             service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                   minor_stat;

     kadm5_server_handle_t       handle;

@@ -1629,9 +1632,9 @@ purgekeys_2_svc(purgekeys_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1641,8 +1644,8 @@ get_strings_2_svc(gstrings_arg *arg, struct svc_req *rqstp)

 {

     static gstrings_ret             ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1688,9 +1691,9 @@ get_strings_2_svc(gstrings_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1700,8 +1703,8 @@ set_string_2_svc(sstring_arg *arg, struct svc_req *rqstp)

 {

     static generic_ret              ret;

     char                            *prime_arg;

-    gss_buffer_desc                 client_name,

-        service_name;

+    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;

     OM_uint32                       minor_stat;

     kadm5_server_handle_t           handle;

     const char                      *errmsg = NULL;

@@ -1744,9 +1747,9 @@ set_string_2_svc(sstring_arg *arg, struct svc_req *rqstp)

             krb5_free_error_message(handle->context, errmsg);

     }

     free(prime_arg);

+exit_func:

     gss_release_buffer(&minor_stat, &client_name);

     gss_release_buffer(&minor_stat, &service_name);

-exit_func:

     free_server_handle(handle);

     return &ret;

 }

@@ -1754,8 +1757,8 @@ exit_func:

 generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)

 {

     static generic_ret         ret;

-    gss_buffer_desc            client_name,

-        service_name;

+    gss_buffer_desc            client_name = GSS_C_EMPTY_BUFFER;

+    gss_buffer_desc            service_name = GSS_C_EMPTY_BUFFER;

     kadm5_server_handle_t      handle;

     OM_uint32                  minor_stat;

     const char                 *errmsg = NULL;

@@ -1797,10 +1800,10 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)

                      rqstp->rq_cred.oa_flavor);

     if (errmsg != NULL)

         krb5_free_error_message(NULL, errmsg);

-    gss_release_buffer(&minor_stat, &client_name);

-    gss_release_buffer(&minor_stat, &service_name);

 exit_func:

+    gss_release_buffer(&minor_stat, &client_name);

+    gss_release_buffer(&minor_stat, &service_name);

     return(&ret;;

 }

-- 

2.7.0.rc3