Access of Uninitialized Pointer in Kerberos 5 - CVE-2023-36054

Vulnerability identifier: #VU79586

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36054

CWE-ID: CWE-824

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to the  _xdr_kadm5_principal_ent_rec() function in lib/kadm5/kadm_rpc_xdr.c does not validate the relationship between n_key_data and the key_data array count and frees an uninitialized pointer. A remote user can send a specially crafted request to the application and perform a denial of service (DoS) attack.

Kerberos 5
Amazon Linux AMI
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server 12 SP2 BCL
Ubuntu
Slackware Linux
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Red Hat OpenShift Builds
Data Lakehouse
cert-manager Operator for Red Hat OpenShift
OpenShift Logging
Red Hat Advanced Cluster Management for Kubernetes
Custom Metrics Autoscaler Operator for Red Hat OpenShift
VMware Tanzu Application Service for VMs
Isolation Segment
Red Hat Migration Toolkit for Applications
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
Juniper Cloud Native Router
Dell EMC PowerProtect Data Protection
IBM Cloud Pak for Watson AIOps
SmartFabric OS10
ObjectScale
EMC ECS
Dell EMC PowerStore Family Operating System
Enterprise SONiC
Platform Automation Toolkit
Storage Ceph
Dell Data Protection Central
OpenShift Virtualization
OpenShift Container Platform for Windows Containers
OpenShift Service Mesh
VMware Tanzu Operations Manager
RecoverPoint for Virtual Machines
libgssapi-krb5-2 (Ubuntu package)
krb5-otp (Ubuntu package)
krb5-kdc-ldap (Ubuntu package)
krb5-kdc (Ubuntu package)
krb5-admin-server (Ubuntu package)
krb5-pkinit (Ubuntu package)
krb5-user (Ubuntu package)
libkdb5-7 (Ubuntu package)
libkadm5srv-mit8 (Ubuntu package)
libkdb5-8 (Ubuntu package)
libkadm5srv-mit9 (Ubuntu package)
libkadm5clnt-mit9 (Ubuntu package)
libkrb5support0 (Ubuntu package)
libkrb5-3 (Ubuntu package)
libkrad0 (Ubuntu package)
libkdb5-9 (Ubuntu package)
libkadm5srv-mit11 (Ubuntu package)
libkadm5clnt-mit11 (Ubuntu package)
libk5crypto3 (Ubuntu package)
libgssrpc4 (Ubuntu package)
krb5-debuginfo-32bit
krb5-doc
krb5-plugin-preauth-pkinit
krb5-plugin-kdb-ldap-debuginfo
krb5-client-debuginfo
krb5-32bit
krb5-debugsource
krb5-devel
krb5-debuginfo
krb5-plugin-preauth-pkinit-debuginfo
krb5-plugin-kdb-ldap
krb5-plugin-preauth-otp-debuginfo
krb5-client
krb5
krb5-server
krb5-plugin-preauth-otp
krb5-server-debuginfo
krb5-32bit-debuginfo
krb5-help
krb5-libs
libkadm5clnt-mit12 (Ubuntu package)
libkadm5srv-mit12 (Ubuntu package)
libkdb5-10 (Ubuntu package)
krb5-plugin-preauth-spake
krb5-plugin-preauth-spake-debuginfo
krb5-devel-64bit
krb5-mini-debuginfo
krb5-mini-devel
krb5-mini-debugsource
krb5-mini
krb5-devel-32bit
krb5-64bit-debuginfo
krb5-64bit
krb5 (Red Hat package)
app-crypt/mit-krb5
Network Observability plugin for the Openshift Console
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
RecoverPoint for VMs
Red Hat Ceph Storage
Dell EMC VxRail Appliance
Junos cRPD

Install updates from vendor's website.

Kerberos 5 - addressed in versions 1.20.2, 1.21.1
Red Hat OpenShift Builds - update to 1.0.1
Data Lakehouse - update to 1.1.0.0
cert-manager Operator for Red Hat OpenShift - addressed in versions 1.11.5, 1.12.1
Dell EMC PowerProtect Data Protection - update to 2.7.8
OpenShift Virtualization - addressed in versions 4.13.6, 4.14.1
OpenShift Logging - update to 5.8.1
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
OpenShift Container Platform for Windows Containers - addressed in versions 9.0.1, 10.15.0
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
libgssapi-krb5-2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-otp (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-kdc-ldap (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-kdc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-admin-server (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-pkinit (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-user (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libkdb5-7 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libkadm5srv-mit8 (Ubuntu package) - update to Ubuntu Pro
libkdb5-8 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libkadm5srv-mit9 (Ubuntu package) - update to Ubuntu Pro
libkadm5clnt-mit9 (Ubuntu package) - update to Ubuntu Pro
libkrb5support0 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libkrb5-3 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libkrad0 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libkdb5-9 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4
libkadm5srv-mit11 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4
libkadm5clnt-mit11 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4
libk5crypto3 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libgssrpc4 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.17-6ubuntu4.4, 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
ObjectScale - update to 1.4.0
Network Observability plugin for the Openshift Console - update to 1.5.0
krb5-debuginfo-32bit - update to 1.12.5-40.52.1
krb5-doc - update to 1.12.5-40.52.1
krb5-plugin-preauth-pkinit - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-plugin-kdb-ldap-debuginfo - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-client-debuginfo - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-32bit - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-debugsource - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-devel - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-debuginfo - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-plugin-preauth-pkinit-debuginfo - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-plugin-kdb-ldap - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-plugin-preauth-otp-debuginfo - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-client - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5 - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-server - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-plugin-preauth-otp - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-server-debuginfo - addressed in versions 1.12.5-40.52.1, 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5 - addressed in versions 1.15.1-55.52, 1.21-3
krb5-32bit-debuginfo - addressed in versions 1.16.3-150100.3.30.1, 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-help - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5-server - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5-client - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5-debugsource - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5-libs - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5-devel - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5-debuginfo - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5 - addressed in versions 1.18.2-7, 1.18.2-8, 1.19.2-8, 1.19.2-9
krb5 - update to 1.19.2
libkadm5clnt-mit12 (Ubuntu package) - addressed in versions 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libkadm5srv-mit12 (Ubuntu package) - addressed in versions 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
libkdb5-10 (Ubuntu package) - addressed in versions 1.19.2-2ubuntu0.3, 1.20.1-1ubuntu0.1
krb5-plugin-preauth-spake - addressed in versions 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-plugin-preauth-spake-debuginfo - addressed in versions 1.19.2-150300.13.1, 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-devel-64bit - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-mini-debuginfo - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-mini-devel - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-mini-debugsource - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-mini - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-devel-32bit - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-64bit-debuginfo - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5-64bit - addressed in versions 1.19.2-150400.3.6.1, 1.20.1-150500.3.3.1
krb5 (Red Hat package) - update to 1.21.1-1.el9
app-crypt/mit-krb5 - update to 1.21.2
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.10.5
VMware Tanzu Operations Manager - update to 2.10.66
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-376
VMware Tanzu Application Service for VMs - addressed in versions 3.0.20, 4.0.12
Isolation Segment - addressed in versions 3.0.20, 4.0.12
EMC ECS - update to 3.8.1.1
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
Enterprise SONiC - update to 4.2.1
Platform Automation Toolkit - addressed in versions 4.4.32, 5.0.25, 5.1.2
EMC ViPR SRM - update to 4.10.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Red Hat Ceph Storage - update to 6.1
Storage Ceph - update to 6.1z3
Red Hat Migration Toolkit for Applications - update to 6.2
Dell EMC VxRail Appliance - update to 8.0.120
Dell Data Protection Central - update to 19.10.0-4
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.30, 23.0.2.2
IBM Automation Decision Services - update to 23.0.2.0.2
Junos cRPD - update to 23.4R1
Juniper Cloud Native Router - update to 23.4R1

• https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final
• https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd
• https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final

• Denial of service in MIT Kerberos 5
• Slackware Linux update for krb5
• SUSE update for krb5
• SUSE update for krb5
• SUSE update for krb5
• SUSE update for krb5
• SUSE update for krb5
• Amazon Linux AMI update for krb5
• Ubuntu update for krb5
• Ubuntu update for krb5
• Red Hat Enterprise Linux 9 update for krb5
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in cert-manager Operator for Red Hat OpenShift 1.12
• Multiple vulnerabilities in cert-manager Operator for Red Hat OpenShift 1.11
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• VMware Tanzu products update for Kerberos
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Red Hat Ceph Storage 6.1
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift
• Access of uninitialized pointer in IBM Storage Ceph
• Dell Data Protection Central update for third-party components
• Multiple vulnerabilities in Red Hat Network Observability
• Multiple vulnerabilities in Red Hat OpenShift for Windows Containers 10.15
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Automation Decision Services
• openEuler 20.03 LTS SP1 update for krb5
• openEuler 20.03 LTS SP3 update for krb5
• openEuler 22.03 LTS update for krb5
• openEuler 22.03 LTS SP1 update for krb5
• openEuler 22.03 LTS SP2 update for krb5
• Multiple vulnerabilities in Red Hat OpenShift for Windows Containers 9.0
• Multiple vulnerabilities in Red Hat OpenShift Builds
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Multiple vulnerabilities in Dell Networking OS10
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Dell PowerStore Family
• Gentoo update for MIT krb5
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in Dell ECS
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Amazon Linux AMI update for krb5
• PowerProtect Data Protection software update for third-party components
• Dell RecoverPoint for Virtual Machines update for third-party components
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)