Fix CVE-2026-55654
Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185831 Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich
parent
5ff57950f5
commit
4c42e8b455
@ -10,8 +10,8 @@ diff --color -ruNp a/configure.ac b/configure.ac
|
||||
AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
|
||||
[Define this if you want to use libkafs' AFS support])])
|
||||
diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
||||
--- a/gss-serv.c 2026-03-10 12:43:36.802443034 +0100
|
||||
+++ b/gss-serv.c 2026-03-12 10:04:37.520993330 +0100
|
||||
--- a/gss-serv.c 2026-06-16 15:38:26.590728235 +0200
|
||||
+++ b/gss-serv.c 2026-06-16 15:41:13.717696103 +0200
|
||||
@@ -53,7 +53,7 @@ extern ServerOptions options;
|
||||
|
||||
static ssh_gssapi_client gssapi_client =
|
||||
@ -21,7 +21,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
||||
|
||||
ssh_gssapi_mech gssapi_null_mech =
|
||||
{ NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
|
||||
@@ -295,6 +295,95 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
|
||||
@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
|
||||
return GSS_S_COMPLETE;
|
||||
}
|
||||
|
||||
@ -44,63 +44,67 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
||||
+ int is_mechname, authenticated, complete, more;
|
||||
+ size_t count, i;
|
||||
+
|
||||
+ /* always initialize client->indicators */
|
||||
+ client->indicators = NULL;
|
||||
+
|
||||
+ ctx->major = gss_inquire_name(&ctx->minor, gss_name,
|
||||
+ &is_mechname, NULL, &attrs);
|
||||
+ if (ctx->major != GSS_S_COMPLETE) {
|
||||
+ return (ctx->major);
|
||||
+ }
|
||||
+ if (ctx->major != GSS_S_COMPLETE)
|
||||
+ return ctx->major;
|
||||
+
|
||||
+ if (attrs == GSS_C_NO_BUFFER_SET) {
|
||||
+ /* No indicators in the ticket */
|
||||
+ return (0);
|
||||
+ /* no indicators in the ticket */
|
||||
+ return GSS_S_COMPLETE;
|
||||
+ }
|
||||
+
|
||||
+ client->indicators = NULL;
|
||||
+ /* client->indicators is NULL terminated */
|
||||
+ count = 0;
|
||||
+ client->indicators = xcalloc(count + 1, sizeof(char *));
|
||||
+
|
||||
+ for (i = 0; i < attrs->count; i++) {
|
||||
+ authenticated = 0;
|
||||
+ complete = 0;
|
||||
+ more = -1;
|
||||
+
|
||||
+ /* skip anything but auth-indicators */
|
||||
+ if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
|
||||
+ memcmp(AUTH_INDICATORS_TAG,
|
||||
+ attrs->elements[i].value,
|
||||
+ memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value,
|
||||
+ sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
|
||||
+ continue;
|
||||
+
|
||||
+ /* retrieve all indicators */
|
||||
+ while (more != 0) {
|
||||
+ value.value = NULL;
|
||||
+ display_value.value = NULL;
|
||||
+
|
||||
+ ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
|
||||
+ &attrs->elements[i], &authenticated,
|
||||
+ &complete, &value, &display_value, &more);
|
||||
+ &attrs->elements[i],
|
||||
+ &authenticated, &complete,
|
||||
+ &value, &display_value, &more);
|
||||
+ if (ctx->major != GSS_S_COMPLETE)
|
||||
+ goto out;
|
||||
+
|
||||
+ if ((value.value != NULL) && authenticated) {
|
||||
+ if (count >= SSH_GSSAPI_MAX_INDICATORS) {
|
||||
+ logit("ssh_gssapi_getindicators: too many "
|
||||
+ "indicators, truncating at %d",
|
||||
+ SSH_GSSAPI_MAX_INDICATORS);
|
||||
+ /* value/display_value released at out: */
|
||||
+ goto done;
|
||||
+ }
|
||||
+ if (value.value == NULL || !authenticated)
|
||||
+ continue;
|
||||
+
|
||||
+ client->indicators = xrecallocarray(client->indicators, count, count + 1, sizeof(char*));
|
||||
+ if (client->indicators == NULL) {
|
||||
+ fatal("ssh_gssapi_getindicators failed to allocate memory");
|
||||
+ }
|
||||
+ client->indicators[count] = xmalloc(value.length + 1);
|
||||
+ memcpy(client->indicators[count], value.value, value.length);
|
||||
+ client->indicators[count][value.length] = '\0';
|
||||
+ count++;
|
||||
+ if (count >= SSH_GSSAPI_MAX_INDICATORS) {
|
||||
+ logit("ssh_gssapi_getindicators:"
|
||||
+ " too many indicators, truncating at %d",
|
||||
+ SSH_GSSAPI_MAX_INDICATORS);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ client->indicators[count] = xmalloc(value.length + 1);
|
||||
+ memcpy(client->indicators[count], value.value, value.length);
|
||||
+ client->indicators[count][value.length] = '\0';
|
||||
+ count++;
|
||||
+
|
||||
+ /* add NULL terminator */
|
||||
+ client->indicators = xrecallocarray(client->indicators, count,
|
||||
+ count + 1, sizeof(char *));
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+done:
|
||||
+ /* slot [count] is zeroed by recallocarray, serves as NULL sentinel */
|
||||
+
|
||||
+out:
|
||||
+ if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) {
|
||||
+ for (i = 0; i < count; i++)
|
||||
@ -108,16 +112,16 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
||||
+ free(client->indicators);
|
||||
+ client->indicators = NULL;
|
||||
+ }
|
||||
+ (void) gss_release_buffer(&ctx->minor, &value);
|
||||
+ (void) gss_release_buffer(&ctx->minor, &display_value);
|
||||
+ (void) gss_release_buffer_set(&ctx->minor, &attrs);
|
||||
+ return (ctx->major);
|
||||
+ gss_release_buffer(&ctx->minor, &value);
|
||||
+ gss_release_buffer(&ctx->minor, &display_value);
|
||||
+ gss_release_buffer_set(&ctx->minor, &attrs);
|
||||
+ return ctx->major;
|
||||
+}
|
||||
+
|
||||
/* Extract the client details from a given context. This can only reliably
|
||||
* be called once for a context */
|
||||
|
||||
@@ -384,6 +473,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
|
||||
@@ -384,6 +477,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
|
||||
}
|
||||
|
||||
gss_release_buffer(&ctx->minor, &ename);
|
||||
@ -130,7 +134,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
||||
|
||||
/* We can't copy this structure, so we just move the pointer to it */
|
||||
client->creds = ctx->client_creds;
|
||||
@@ -446,6 +541,7 @@ int
|
||||
@@ -446,6 +545,7 @@ int
|
||||
ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
|
||||
{
|
||||
OM_uint32 lmin;
|
||||
@ -138,7 +142,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
||||
|
||||
(void) kex; /* used in privilege separation */
|
||||
|
||||
@@ -464,8 +560,14 @@ ssh_gssapi_userok(char *user, struct pas
|
||||
@@ -464,8 +564,14 @@ ssh_gssapi_userok(char *user, struct pas
|
||||
gss_release_buffer(&lmin, &gssapi_client.displayname);
|
||||
gss_release_buffer(&lmin, &gssapi_client.exportedname);
|
||||
gss_release_cred(&lmin, &gssapi_client.creds);
|
||||
|
||||
@ -744,6 +744,9 @@ test -f %{sysconfig_anaconda} && \
|
||||
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
|
||||
FIPS known-group validation that leads to client-side denial of service
|
||||
Resolves: RHEL-185776
|
||||
- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
|
||||
cleanup due to missing NULL terminator
|
||||
Resolves: RHEL-185831
|
||||
|
||||
* Tue Apr 14 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-26
|
||||
- Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication
|
||||
|
||||
Loading…
Reference in New Issue
Block a user