In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: svcauth_gss: enforce krb5 token minimum length<\/p>\n
svcauth_gss_unwrap_priv() validates only an upper bound on the
\nwire-supplied opaque length before handing the buffer to
\ngss_unwrap():<\/p>\n
if (len > xdr_stream_remaining(xdr))
\n goto unwrap_failed;
\n offset = xdr_stream_pos(xdr);
\n …
\n maj_stat = gss_unwrap(ctx, offset, offset + len, buf);<\/p>\n
The wire value `len` flows unchanged as the upper bound into the
\nkrb5 unwrap path, so a len in [0, 16] passes this check and is
\nhanded to gss_unwrap(). For a krb5 v2 context that lands in
\ngss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token
\nheader fields at ptr+4 and ptr+6 and then calls rotate_left()
\nbefore any integrity check. With a sub-header length the header
\nreads run past the token, and _rotate_left()’s `shift %= buf->len`
\npath can divide by zero when buf->len has been driven to zero by
\nthe truncated token. A header-only token (len == 16) is equally
\ninvalid: with a non-zero RRC field and the opaque blob ending at
\nthe XDR buffer boundary, rotate_left() builds a zero-length
\nsubbuffer, reaching the same division.<\/p>\n
Reject the token at the server entry point before it reaches the
\nkrb5 unwrap core. A valid sealed RFC 4121 token must contain
\nthe 16-byte header plus at least some encrypted payload.<\/p>\n
Fix by adding a minimum-length check immediately after the
\nexisting upper-bound check:<\/p>\n
if (len <= GSS_KRB5_TOK_HDR_LEN)
\n goto unwrap_failed;<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: svcauth_gss: enforce krb5 token minimum length<\/p>\n
svcauth_gss_unwrap_priv() validates only an upper bound on the
\nwire-supplie<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21472","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}