CVE-2023-25566 (published 2023-02-14T18:15Z)

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridden causing an allocated memory area the size of the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0.\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/gssapi/gss-ntlmssp
commit_details: repo_url: https://github.com/gssapi/gss-ntlmssp
author: Simo Sorce
author_date: 2023-02-07 11:43:35-05:00
msg: GHSL-2023-010: Memory leak when parsing usernames

Memory leak when parsing usernames (GHSL-2023-010)

Fixes defect GHSL-2023-010 found by the GitHub Security Lab team via
oss-fuzz.

The domain portion may be overridden causing an allocated memory area
the size of the domain name to be lost. This could be used to mount a
DoS by depleeting the server memory.

Signed-off-by: Simo Sorce <simo@redhat.com>
repository: repo_url: https://github.com/gssapi/gss-ntlmssp
repo_name: gssapi/gss-ntlmssp
description: A complete implementation of the MS-NLMP documents as a GSSAPI mechanism
repo_language: C
owner: gssapi
file_changes: filename: gss_names.c
change_type: ModificationType.MODIFY
diff: @@ -136,7 +136,6 @@ static uint32_t parse_user_name(uint32_t *minor_status,
         /* we may have an enterprise name here */
         char strbuf[len + 1];
         char *buf = strbuf;
-        bool domain_handled = false;
 
         /* copy buf to manipulate it */
         memcpy(buf, str, len);
@@ -160,9 +159,6 @@ static uint32_t parse_user_name(uint32_t *minor_status,
         }
 
         if (sep) {
-            /* leading domain, copy if domain name is not empty */
-            domain_handled = true;
-
             /* terminate and copy domain, even if empty */
             /* NOTE: this is important for the Windbind integration case
              * where we need to tell the machinery to *not* add the default
@@ -180,7 +176,7 @@ static uint32_t parse_user_name(uint32_t *minor_status,
 
         for (at = strchr(buf, '@'); at != NULL; at = strchr(at, '@')) {
             if (*(at - 1) == '\\') {
-                if (domain_handled) {
+                if (*domain) {
                     /* Invalid forms like DOM\foo\@bar or foo@bar\@baz */
                     free(*domain);
                     *domain = NULL;
@@ -189,7 +185,7 @@ static uint32_t parse_user_name(uint32_t *minor_status,
                 }
                 /* remove escape, moving all including terminating '\0' */
                 memmove(at - 1, at, len - (at - buf) + 1);
-            } else if (!domain_handled) {
+            } else if (!*domain) {
                 /* an '@' without escape and no previous
                  * domain was split out.
                  * the rest of the string is the domain */

programming_language: C