From nobody Fri May 1 00:11:38 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g6BKl3bzmz6cY0H for ; Fri, 01 May 2026 00:11:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g6BKk6BW8z40Rx for ; Fri, 01 May 2026 00:11:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777594298; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ndtA5kdCKZUfBxsSzT67ec39OzG8scMhoSCpIdAMHyM=; b=ANSqC3hqDz1vo+y0BQ/whHwcVbzuZv0z+nEwP7Nj/Z6ER//z994l1mSmslex+yFssPL/ik CqAJMr+0U72a1Xy0FRrQBg7nZhLcQFroqArgl9Kot7mqVrJ15NcPZHfIlqAQYiFiNAKg9o 6nlPExltqdD5Jj0y4AEcPUFgUSf7UZYczWJJwzeXmVfJOeR6Ore7hlfbgXcsmi988WDaxI xU448vSWgd92jEPFIckJ9UTGRs8SSrpWh8e2KCKI+opE/ovVyyxKWiwBssOptssOjXaUs5 PaqBQ9r0XBLrwkUw4FCykrSonSt6iYwR2YypKzPC/G9MjnSyxGg6w+NyMKUBKg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777594298; a=rsa-sha256; cv=none; b=V6b8ah/dIGmwkDh/AxxMJVR8MNnlc0tRHRhSKKJFvzRZNCO8bt2FvbMu48zBmcK2Dv22md CWbgjnc3t/2vMbxh0g1vi5Qt6gXALOejCPfR3yvpBv2+6qcVpYrgxwosi3seIhDQX1GClv D9Plu3MvHzg+3SzpTcs1i2wqFPOyccEg1NpKLbEAEV6JgB1tne5pDhHktWPU4lBWb9xnqs a6vAASIjAepodmNyvNJ/icQl8gcoL8jJB5ydSrTBvuKzTH5VtVyN6VRRhfUQUwYBUpDHJ1 ijFty7M+rMv52WjUPnHQSiRaAFTqq/oNJCpMvbHfjBiQVWBNp266k1jfD42N3g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777594298; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ndtA5kdCKZUfBxsSzT67ec39OzG8scMhoSCpIdAMHyM=; b=P5tk/cEE2Eofm8JUVhpArorkJB/Pgq1sWf78UCDRf7oHJxnjzT/5j+5jHuVF3Rn8U6f69k 2EpSgk2N6+DsJSxCqr9ipa6ibOEefw3IfnrF23jWwcFMFzF2AGFSr8Jy8JKqIa6WrLooty i2fsi3xKpgqW1BJTcfw5w3lJmsTRNpy8+kVCpoS8cztRu52pgDb8+h8FV8jrma+iCytAOz fYw6ocp7Rxs7Qt0oCK5B1JUSdKDjfTISVyW2DMrcG7/eIDyv1KZGhkT48ykl9ZunoQmZk+ nmQncRmmf+Tkf09SItXdFM/o9djfx5MY0TC5PGNnlUG/lM23sfRydqRaKY5GTA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g6BKk5V5gzbVk for ; Fri, 01 May 2026 00:11:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 307f2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 01 May 2026 00:11:38 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Cy Schubert Subject: git: c9dd7bffa58c - main - krb5: Fix two NegoEx parsing vulnerabilities List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c9dd7bffa58c50b2f7ed9e66ace39197c468d8e6 Auto-Submitted: auto-generated Date: Fri, 01 May 2026 00:11:38 +0000 Message-Id: <69f3efba.307f2.6f425dba@gitrepo.freebsd.org> The branch main has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=c9dd7bffa58c50b2f7ed9e66ace39197c468d8e6 commit c9dd7bffa58c50b2f7ed9e66ace39197c468d8e6 Author: Cy Schubert AuthorDate: 2026-04-30 19:27:31 +0000 Commit: Cy Schubert CommitDate: 2026-05-01 00:11:25 +0000 krb5: Fix two NegoEx parsing vulnerabilities Bring in upstream commit 2e75f0d93 fixing two CVEs. Upstream commit log is: In parse_nego_message(), check the result of the second call to vector_base() before dereferencing it. In parse_message(), check for a short header_len to prevent an integer underflow when calculating the remaining message length. Reported by Cem Onat Karagun. CVE-2026-40355: In MIT krb5 release 1.18 and later, if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech, an unauthenticated remote attacker can trigger a null pointer dereference, causing the process to terminate. CVE-2026-40356: In MIT krb5 release 1.18 and later, if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech, an unauthenticated remote attacker can trigger a read overrun of up to 52 bytes, possibly causing the process to terminate. Exfiltration of the bytes read does not appear possible. --- crypto/krb5/src/lib/gssapi/spnego/negoex_util.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c b/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c index edc5462e8441..a65238e57305 100644 --- a/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c +++ b/crypto/krb5/src/lib/gssapi/spnego/negoex_util.c @@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in, offset = k5_input_get_uint32_le(in); count = k5_input_get_uint16_le(in); p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len); + if (p == NULL) { + *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE; + return GSS_S_DEFECTIVE_TOKEN; + } for (i = 0; i < count; i++) { extension_type = load_32_le(p + i * EXTENSION_LENGTH); if (extension_type & EXTENSION_FLAG_CRITICAL) { @@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in, msg_len = k5_input_get_uint32_le(in); conv_id = k5_input_get_bytes(in, GUID_LENGTH); - if (in->status || msg_len > token_remaining || header_len > msg_len) { + if (in->status || msg_len > token_remaining || + header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) { *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE; return GSS_S_DEFECTIVE_TOKEN; }