blob: 6610899458ed906cf96252c1ba9e0b3610851972 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
From f9ec7002cdd526ae84fbacbf153162e118f22580 Mon Sep 17 00:00:00 2001
From: Nicolas Williams <nico@twosigma.com>
Date: Wed Mar 9 10:18:52 2022 -0600
Subject: [PATCH] spnego: CVE-2021-44758 send_reject when no mech selected
This fixes a DoS where an initial SPNEGO token that has no acceptable
mechanisms causes a NULL dereference in acceptors.
send_accept() when called with a non-zero 'initial_response' did
not handle the case of gssspnego_ctx.preferred_mech_type equal
to GSS_C_NO_OID.
The failure to handle GSS_C_NO_OID has been present since the
initial revision of gssapi/spnego,
2baa7e7d613c26b2b037b368931519a84baec53d but might not have
been exercised until later revisions.
The introduction of opportunistic token handling in
gss_accept_sec_context(), 3c9d3266f47f594a29068c9d629908e7000ac663,
introduced two bugs:
1. The optional mechToken field is used unconditionally
possibly resulting in a segmentation fault.
2. If use of the opportunistic token is unsuccessful and the
mech type list length is one, send_accept() can be called
with 'initial_response' true and preferred mech set to
GSS_C_NO_OID.
b53c90da0890a9cce6f95c552f094ff6d69027bf ("Make error reporting
somewhat more correct for SPNEGO") attempted to fix the first
issue and increased the likelihood of the second.
This change alters the behavior of acceptor_start() so it calls
send_reject() when no mechanism was selected.
Upstream-Status: Backport [https://github.com/heimdal/heimdal/commit/f9ec7002cdd526ae84fbacbf153162e118f22580]
CVE: CVE-2021-44758
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
.../heimdal/lib/gssapi/spnego/accept_sec_context.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/lib/gssapi/spnego/accept_sec_context.c b/lib/gssapi/spnego/accept_sec_context.c
index 3a51dd3..b60dc19 100644
--- a/lib/gssapi/spnego/accept_sec_context.c
+++ b/lib/gssapi/spnego/accept_sec_context.c
@@ -619,13 +619,15 @@ acceptor_start
if (ret == 0)
break;
}
- if (preferred_mech_type == GSS_C_NO_OID) {
- HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
- free_NegotiationToken(&nt);
- return ret;
- }
+ }
+
+ ctx->preferred_mech_type = preferred_mech_type;
- ctx->preferred_mech_type = preferred_mech_type;
+ if (preferred_mech_type == GSS_C_NO_OID) {
+ send_reject(minor_status, output_token);
+ HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+ free_NegotiationToken(&nt);
+ return ret;
}
/*
--
2.40.0
|
