From nobody Mon May 4 11:57:36 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g8Krx0ZMfz6RZpV for ; Mon, 04 May 2026 11:57:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g8Krw4M5Yz42x3 for ; Mon, 04 May 2026 11:57:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777895856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=B/8bIuI7Wx9FIqd/tqILuJAHJNJGw50VKbGNQvJ/N2A=; b=AvoDwhSBWYpDDmRDNl3IvnhQksRk56OZAmMUt16E7UbWILExKMJGRZSaayNsNC3GY9Bzzj P6hJW76HbsXy07mMvGifoO1kRnN4aeyLWGVjJUQf76BMw6e+FoeIJ4GUxEMiXtcMRtknJf Z8lkFQL63fRM64RG0W9bb+ZPnK1Dp/Y5Uc8BJRMEo1rGZx81lIgoxjwJst9MZ9XsEgr1zW LY6DC5N5d3+hjqCic1C4p9lYN43ck8k1b9fwmHx9Y6nBORcuMCZwhVlr3RwWXQZvaIWJLQ zbKq0lhSR1kaXGZYlve8LJppzUJwtXVXO07U/9BFcoTqR2uJgC1Jyc18UhcFgg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777895856; a=rsa-sha256; cv=none; b=Z3wHkYzCsaqPOg6zCZSFQit9AJSntA+dO+QWdRQy7nLPAsn4DlkErkm4zmh3Ga8u5l+gei QK8j5xj8AvfJmPWS8jcyeZuZjfhrSLr1pC2frI6kQ8I9qucFXiTgg6Ccr84uARnjtFuoD3 Sf1pZGbrqO0JcvZVmR3PI8dAptkg5DACWZ3d5OyDOc4td+tZ8mNN/pHx3y8Uj0KyEEcKgI OxuteOxbiMfmzu8RYiq072OM7hv9GJYaDJ3KzOnTbk32AlG4Tga5iNOEpTvV7rPQRaYM62 NMXKms2JkuoD8qCDoPbqAybXRhO2AvwLTn2u3fVSS3f9UQL/J7qhDzYYl/g+mA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777895856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=B/8bIuI7Wx9FIqd/tqILuJAHJNJGw50VKbGNQvJ/N2A=; b=SlpCPK4vwdcfVyAqSn67r71aFnHlsDF8bS5OTVXDtJhjjngU7t6pPSjXkVtsAD9S7tBgLf B+VEOQQ7fnSK76G/2z/BMzTmMbghDJzN5IzaXotyPYIKjxBrW6dsQcC2QS9ToSxayzrnfD zMuzZ40QuAi9sxjBFCOp1u01eYNpRflycT/Zbm32zk/46fww0usEJ1zKXfLm3B8UYNHJ6O CPRZAnEGSQ0vF2m7jSu2gONeEgzyEo4wZDGNid9EpGtlMKf1PtxucZPFpmm6zCBWZ0x4xE 1jBc6bLX7PbX9ydhEfX2ucVbs63n65I//Qv7espZzMtSr+Q45kVOX9venNPWWg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g8Krw3H3Mz3bX for ; Mon, 04 May 2026 11:57:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 362d1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 04 May 2026 11:57:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: a22ad16deb2c - stable/15 - krb5: Fix two NegoEx parsing vulnerabilities List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a22ad16deb2ce23050c949b43210f5c6feb5afa8 Auto-Submitted: auto-generated Date: Mon, 04 May 2026 11:57:36 +0000 Message-Id: <69f889b0.362d1.23163885@gitrepo.freebsd.org> The branch stable/15 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=a22ad16deb2ce23050c949b43210f5c6feb5afa8 commit a22ad16deb2ce23050c949b43210f5c6feb5afa8 Author: Cy Schubert AuthorDate: 2026-04-30 19:27:31 +0000 Commit: Cy Schubert CommitDate: 2026-05-04 11:57:26 +0000 krb5: Fix two NegoEx parsing vulnerabilities Bring in upstream commit 2e75f0d93 fixing two CVEs. Upstream commit log is: In parse_nego_message(), check the result of the second call to vector_base() before dereferencing it. In parse_message(), check for a short header_len to prevent an integer underflow when calculating the remaining message length. Reported by Cem Onat Karagun. CVE-2026-40355: In MIT krb5 release 1.18 and later, if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech, an unauthenticated remote attacker can trigger a null pointer dereference, causing the process to terminate. CVE-2026-40356: In MIT krb5 release 1.18 and later, if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech, an unauthenticated remote attacker can trigger a read overrun of up to 52 bytes, possibly causing the process to terminate. Exfiltration of the bytes read does not appear possible. (cherry picked from commit c9dd7bffa58c50b2f7ed9e66ace39197c468d8e6) --- crypto/krb5/src/lib/gssapi/spnego/negoex_util.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c b/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c index edc5462e8441..a65238e57305 100644 --- a/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c +++ b/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c @@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in, offset = k5_input_get_uint32_le(in); count = k5_input_get_uint16_le(in); p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len); + if (p == NULL) { + *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE; + return GSS_S_DEFECTIVE_TOKEN; + } for (i = 0; i < count; i++) { extension_type = load_32_le(p + i * EXTENSION_LENGTH); if (extension_type & EXTENSION_FLAG_CRITICAL) { @@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in, msg_len = k5_input_get_uint32_le(in); conv_id = k5_input_get_bytes(in, GUID_LENGTH); - if (in->status || msg_len > token_remaining || header_len > msg_len) { + if (in->status || msg_len > token_remaining || + header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) { *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE; return GSS_S_DEFECTIVE_TOKEN; }