From nobody Thu May 14 19:05:03 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gGfsW49jqz5WrN7 for ; Thu, 14 May 2026 19:05:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gGfsW3RpCz47BF for ; Thu, 14 May 2026 19:05:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1778785503; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QywnHLg6+DXbHKghz2sZYQYLBV5Ff2mV9PTerx8OITA=; b=YowmhNCGIkI/k6sH3MghBNBTwwdiytBYHEbDZ0HQkfUDF7gX9OpFNtRajcyXZBY0+py2ew uiGEbH1Oc4UFDO3RPIh1SY394dSkaletQzfIr9ABuosIl11IxPRXygyLvV0E7GwXolZUgg Rdv7zNCl5CT/2g5Dn6hrRCSzGFpFBTOCSwxnEdqOAWlCSxTnylm0O9/07lLkOorbgo9URo io1EMQTSqDCzjH+bCP9vmd/NvwGbaDP4HbUglMy5octIOBxVT4QP0vCnqRPDUk+i8S6PFr La/fivbbVPoVJ26gFuVJIuFRXHRS3JfmvfC+qMg5ohWWet69DCZ5KI/+WkGGDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1778785503; a=rsa-sha256; cv=none; b=smqu6TDupe83qD/D4T/BbXihSd4V6SitQJNtjWoSPtzKS5u4ZmSTDKDm2HqKGzy25t6os6 rqcwATQFpdkIQ3o4EqfV1BsQ93jrsufnq90S0+Q0LqDueFR+WBbCYN5q24KtkCfl1Z0mol 8tRywbbIY17p+ZR4+nCmVcbwuNRG7aIYmzdeAuD8ZSS432qAV0PLlJcoL9cdyxdrbaGdjV LufewajgYdMAb01rwAOt3qZq0AJPpONJ33CDWBiAYy1F052k9awAFjYTvJi6wy1aMkdN6Y DsB7uWhV7WgvuOcUyduPBWmCvnn23WzYpnqg4KGENjZDTYpujyiOMOtSZAE7cQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1778785503; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QywnHLg6+DXbHKghz2sZYQYLBV5Ff2mV9PTerx8OITA=; b=BX9o9IRb6rJTxspokUm0fpkWXsALxHAY2rMDfJyWRVbip7PUlBXXLsr/Qj+4f8ATwmP6De xMfnGXxOMYhkjGyrVT6gfQnz2BX648ynJlHcLIB9qPS4l7NyGtBbGi0og5hlgGnnjw7HD6 AyhQbqpKaZv8n/buzyxxP9aK55i0rFEEFTS6ZzZLJykbqG3SXbuzWvuIe4PNxzY4S/R1hn BJ3e8E7RAhdH9XNiIybPSZbV4pMhwAF9H1nphBI0z5zA1+0LvBr6USorvFL1+ua/a2Gw2s 2IKkUcPawnD4sV/0V9IhxeAd0fL2g5Mtobsc0f0nzW8BxhL0BCMiiYp/noyjsg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gGfsW2WCZzqY8 for ; Thu, 14 May 2026 19:05:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25cd5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 14 May 2026 19:05:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Cy Schubert From: Colin Percival Subject: git: 92eeed88a416 - releng/15.1 - krb5: Fix two NegoEx parsing vulnerabilities List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 92eeed88a416ec63d4fb1ad88df8d76fd70a528c Auto-Submitted: auto-generated Date: Thu, 14 May 2026 19:05:03 +0000 Message-Id: <6a061cdf.25cd5.7d9b6eec@gitrepo.freebsd.org> The branch releng/15.1 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=92eeed88a416ec63d4fb1ad88df8d76fd70a528c commit 92eeed88a416ec63d4fb1ad88df8d76fd70a528c Author: Cy Schubert AuthorDate: 2026-04-30 19:27:31 +0000 Commit: Colin Percival CommitDate: 2026-05-14 19:04:13 +0000 krb5: Fix two NegoEx parsing vulnerabilities Bring in upstream commit 2e75f0d93 fixing two CVEs. Upstream commit log is: In parse_nego_message(), check the result of the second call to vector_base() before dereferencing it. In parse_message(), check for a short header_len to prevent an integer underflow when calculating the remaining message length. Reported by Cem Onat Karagun. CVE-2026-40355: In MIT krb5 release 1.18 and later, if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech, an unauthenticated remote attacker can trigger a null pointer dereference, causing the process to terminate. CVE-2026-40356: In MIT krb5 release 1.18 and later, if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech, an unauthenticated remote attacker can trigger a read overrun of up to 52 bytes, possibly causing the process to terminate. Exfiltration of the bytes read does not appear possible. Approved by: re (cperciva) (cherry picked from commit c9dd7bffa58c50b2f7ed9e66ace39197c468d8e6) (cherry picked from commit a22ad16deb2ce23050c949b43210f5c6feb5afa8) --- crypto/krb5/src/lib/gssapi/spnego/negoex_util.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c b/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c index edc5462e8441..a65238e57305 100644 --- a/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c +++ b/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c @@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in, offset = k5_input_get_uint32_le(in); count = k5_input_get_uint16_le(in); p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len); + if (p == NULL) { + *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE; + return GSS_S_DEFECTIVE_TOKEN; + } for (i = 0; i < count; i++) { extension_type = load_32_le(p + i * EXTENSION_LENGTH); if (extension_type & EXTENSION_FLAG_CRITICAL) { @@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in, msg_len = k5_input_get_uint32_le(in); conv_id = k5_input_get_bytes(in, GUID_LENGTH); - if (in->status || msg_len > token_remaining || header_len > msg_len) { + if (in->status || msg_len > token_remaining || + header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) { *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE; return GSS_S_DEFECTIVE_TOKEN; }