diff --git a/0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch b/0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch deleted file mode 100644 index 31cfbff..0000000 --- a/0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch +++ /dev/null @@ -1,50 +0,0 @@ -From f0c094a1b745d91ef2f9a4eae2149aac026a5789 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 25 Sep 2015 12:51:47 -0400 -Subject: [PATCH] Fix build_principal memory bug [CVE-2015-2697] - -In build_principal_va(), use k5memdup0() instead of strdup() to make a -copy of the realm, to ensure that we allocate the correct number of -bytes and do not read past the end of the input string. This bug -affects krb5_build_principal(), krb5_build_principal_va(), and -krb5_build_principal_alloc_va(). krb5_build_principal_ext() is not -affected. - -CVE-2015-2697: - -In MIT krb5 1.7 and later, an authenticated attacker may be able to -cause a KDC to crash using a TGS request with a large realm field -beginning with a null byte. If the KDC attempts to find a referral to -answer the request, it constructs a principal name for lookup using -krb5_build_principal() with the requested realm. Due to a bug in this -function, the null byte causes only one byte be allocated for the -realm field of the constructed principal, far less than its length. -Subsequent operations on the lookup principal may cause a read beyond -the end of the mapped memory region, causing the KDC process to crash. - -CVSSv2: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C - -ticket: 8252 (new) -target_version: 1.14 -tags: pullup - -diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c -index ab6fed8..8604268 100644 ---- a/src/lib/krb5/krb/bld_princ.c -+++ b/src/lib/krb5/krb/bld_princ.c -@@ -40,10 +40,8 @@ build_principal_va(krb5_context context, krb5_principal princ, - data = malloc(size * sizeof(krb5_data)); - if (!data) { retval = ENOMEM; } - -- if (!retval) { -- r = strdup(realm); -- if (!r) { retval = ENOMEM; } -- } -+ if (!retval) -+ r = k5memdup0(realm, rlen, &retval); - - while (!retval && (component = va_arg(ap, char *))) { - if (count == size) { --- -2.6.2 - diff --git a/0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch b/0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch deleted file mode 100644 index 2a0a8ca..0000000 --- a/0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch +++ /dev/null @@ -1,729 +0,0 @@ -From e04f0283516e80d2f93366e0d479d13c9b5c8c2a Mon Sep 17 00:00:00 2001 -From: Nicolas Williams -Date: Mon, 14 Sep 2015 12:28:36 -0400 -Subject: [PATCH] Fix IAKERB context aliasing bugs [CVE-2015-2696] - -The IAKERB mechanism currently replaces its context handle with the -krb5 mechanism handle upon establishment, under the assumption that -most GSS functions are only called after context establishment. This -assumption is incorrect, and can lead to aliasing violations for some -programs. Maintain the IAKERB context structure after context -establishment and add new IAKERB entry points to refer to it with that -type. Add initiate and established flags to the IAKERB context -structure for use in gss_inquire_context() prior to context -establishment. - -CVE-2015-2696: - -In MIT krb5 1.9 and later, applications which call -gss_inquire_context() on a partially-established IAKERB context can -cause the GSS-API library to read from a pointer using the wrong type, -generally causing a process crash. Java server applications using the -native JGSS provider are vulnerable to this bug. A carefully crafted -IAKERB packet might allow the gss_inquire_context() call to succeed -with attacker-determined results, but applications should not make -access control decisions based on gss_inquire_context() results prior -to context establishment. - - CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C - -[ghudson@mit.edu: several bugfixes, style changes, and edge-case -behavior changes; commit message and CVE description] - -ticket: 8244 -target_version: 1.14 -tags: pullup - -diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index 9aae12a..97e090d 100644 ---- a/src/lib/gssapi/krb5/gssapiP_krb5.h -+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h -@@ -621,6 +621,21 @@ OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context_ext - ); - #endif /* LEAN_CLIENT */ - -+OM_uint32 KRB5_CALLCONV krb5_gss_inquire_sec_context_by_oid -+(OM_uint32*, /* minor_status */ -+ const gss_ctx_id_t, -+ /* context_handle */ -+ const gss_OID, /* desired_object */ -+ gss_buffer_set_t* /* data_set */ -+); -+ -+OM_uint32 KRB5_CALLCONV krb5_gss_set_sec_context_option -+(OM_uint32*, /* minor_status */ -+ gss_ctx_id_t*, /* context_handle */ -+ const gss_OID, /* desired_object */ -+ const gss_buffer_t/* value */ -+); -+ - OM_uint32 KRB5_CALLCONV krb5_gss_process_context_token - (OM_uint32*, /* minor_status */ - gss_ctx_id_t, /* context_handle */ -@@ -1302,6 +1317,105 @@ OM_uint32 KRB5_CALLCONV - krb5_gss_import_cred(OM_uint32 *minor_status, gss_buffer_t token, - gss_cred_id_t *cred_handle); - -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_process_context_token(OM_uint32 *minor_status, -+ const gss_ctx_id_t context_handle, -+ const gss_buffer_t token_buffer); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ OM_uint32 *time_rec); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_inquire_context(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, gss_name_t *src_name, -+ gss_name_t *targ_name, OM_uint32 *lifetime_rec, -+ gss_OID *mech_type, OM_uint32 *ctx_flags, -+ int *locally_initiated, int *opened); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_qop_t qop_req, gss_buffer_t message_buffer, -+ gss_buffer_t message_token); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_qop_t qop_req, gss_iov_buffer_desc *iov, -+ int iov_count); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, gss_qop_t qop_req, -+ gss_iov_buffer_desc *iov, int iov_count); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_buffer_t msg_buffer, gss_buffer_t token_buffer, -+ gss_qop_t *qop_state); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_qop_t *qop_state, gss_iov_buffer_desc *iov, -+ int iov_count); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int conf_req_flag, gss_qop_t qop_req, -+ gss_buffer_t input_message_buffer, int *conf_state, -+ gss_buffer_t output_message_buffer); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int conf_req_flag, gss_qop_t qop_req, int *conf_state, -+ gss_iov_buffer_desc *iov, int iov_count); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap_iov_length(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, int conf_req_flag, -+ gss_qop_t qop_req, int *conf_state, -+ gss_iov_buffer_desc *iov, int iov_count); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_buffer_t input_message_buffer, -+ gss_buffer_t output_message_buffer, int *conf_state, -+ gss_qop_t *qop_state); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int *conf_state, gss_qop_t *qop_state, -+ gss_iov_buffer_desc *iov, int iov_count); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap_size_limit(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, int conf_req_flag, -+ gss_qop_t qop_req, OM_uint32 req_output_size, -+ OM_uint32 *max_input_size); -+ -+#ifndef LEAN_CLIENT -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_export_sec_context(OM_uint32 *minor_status, -+ gss_ctx_id_t *context_handle, -+ gss_buffer_t interprocess_token); -+#endif /* LEAN_CLIENT */ -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status, -+ const gss_ctx_id_t context_handle, -+ const gss_OID desired_object, -+ gss_buffer_set_t *data_set); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_set_sec_context_option(OM_uint32 *minor_status, -+ gss_ctx_id_t *context_handle, -+ const gss_OID desired_object, -+ const gss_buffer_t value); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int prf_key, const gss_buffer_t prf_in, -+ ssize_t desired_output_len, gss_buffer_t prf_out); -+ - /* Magic string to identify exported krb5 GSS credentials. Increment this if - * the format changes. */ - #define CRED_EXPORT_MAGIC "K5C1" -diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c -index 0be92e4..c4dfdd6 100644 ---- a/src/lib/gssapi/krb5/gssapi_krb5.c -+++ b/src/lib/gssapi/krb5/gssapi_krb5.c -@@ -351,7 +351,7 @@ static struct { - } - }; - --static OM_uint32 KRB5_CALLCONV -+OM_uint32 KRB5_CALLCONV - krb5_gss_inquire_sec_context_by_oid (OM_uint32 *minor_status, - const gss_ctx_id_t context_handle, - const gss_OID desired_object, -@@ -465,7 +465,7 @@ static struct { - }; - #endif - --static OM_uint32 KRB5_CALLCONV -+OM_uint32 KRB5_CALLCONV - krb5_gss_set_sec_context_option (OM_uint32 *minor_status, - gss_ctx_id_t *context_handle, - const gss_OID desired_object, -@@ -929,20 +929,103 @@ static struct gss_config krb5_mechanism = { - krb5_gss_get_mic_iov_length, - }; - -+/* Functions which use security contexts or acquire creds are IAKERB-specific; -+ * other functions can borrow from the krb5 mech. */ -+static struct gss_config iakerb_mechanism = { -+ { GSS_MECH_KRB5_OID_LENGTH, GSS_MECH_KRB5_OID }, -+ NULL, -+ iakerb_gss_acquire_cred, -+ krb5_gss_release_cred, -+ iakerb_gss_init_sec_context, -+#ifdef LEAN_CLIENT -+ NULL, -+#else -+ iakerb_gss_accept_sec_context, -+#endif -+ iakerb_gss_process_context_token, -+ iakerb_gss_delete_sec_context, -+ iakerb_gss_context_time, -+ iakerb_gss_get_mic, -+ iakerb_gss_verify_mic, -+#if defined(IOV_SHIM_EXERCISE_WRAP) || defined(IOV_SHIM_EXERCISE) -+ NULL, -+#else -+ iakerb_gss_wrap, -+#endif -+#if defined(IOV_SHIM_EXERCISE_UNWRAP) || defined(IOV_SHIM_EXERCISE) -+ NULL, -+#else -+ iakerb_gss_unwrap, -+#endif -+ krb5_gss_display_status, -+ krb5_gss_indicate_mechs, -+ krb5_gss_compare_name, -+ krb5_gss_display_name, -+ krb5_gss_import_name, -+ krb5_gss_release_name, -+ krb5_gss_inquire_cred, -+ NULL, /* add_cred */ -+#ifdef LEAN_CLIENT -+ NULL, -+ NULL, -+#else -+ iakerb_gss_export_sec_context, -+ NULL, -+#endif -+ krb5_gss_inquire_cred_by_mech, -+ krb5_gss_inquire_names_for_mech, -+ iakerb_gss_inquire_context, -+ krb5_gss_internal_release_oid, -+ iakerb_gss_wrap_size_limit, -+ krb5_gss_localname, -+ krb5_gss_authorize_localname, -+ krb5_gss_export_name, -+ krb5_gss_duplicate_name, -+ krb5_gss_store_cred, -+ iakerb_gss_inquire_sec_context_by_oid, -+ krb5_gss_inquire_cred_by_oid, -+ iakerb_gss_set_sec_context_option, -+ krb5_gssspi_set_cred_option, -+ krb5_gssspi_mech_invoke, -+ NULL, /* wrap_aead */ -+ NULL, /* unwrap_aead */ -+ iakerb_gss_wrap_iov, -+ iakerb_gss_unwrap_iov, -+ iakerb_gss_wrap_iov_length, -+ NULL, /* complete_auth_token */ -+ NULL, /* acquire_cred_impersonate_name */ -+ NULL, /* add_cred_impersonate_name */ -+ NULL, /* display_name_ext */ -+ krb5_gss_inquire_name, -+ krb5_gss_get_name_attribute, -+ krb5_gss_set_name_attribute, -+ krb5_gss_delete_name_attribute, -+ krb5_gss_export_name_composite, -+ krb5_gss_map_name_to_any, -+ krb5_gss_release_any_name_mapping, -+ iakerb_gss_pseudo_random, -+ NULL, /* set_neg_mechs */ -+ krb5_gss_inquire_saslname_for_mech, -+ krb5_gss_inquire_mech_for_saslname, -+ krb5_gss_inquire_attrs_for_mech, -+ krb5_gss_acquire_cred_from, -+ krb5_gss_store_cred_into, -+ iakerb_gss_acquire_cred_with_password, -+ krb5_gss_export_cred, -+ krb5_gss_import_cred, -+ NULL, /* import_sec_context_by_mech */ -+ NULL, /* import_name_by_mech */ -+ NULL, /* import_cred_by_mech */ -+ iakerb_gss_get_mic_iov, -+ iakerb_gss_verify_mic_iov, -+ iakerb_gss_get_mic_iov_length, -+}; -+ - #ifdef _GSS_STATIC_LINK - #include "mglueP.h" - static int gss_iakerbmechglue_init(void) - { - struct gss_mech_config mech_iakerb; -- struct gss_config iakerb_mechanism = krb5_mechanism; -- -- /* IAKERB mechanism mirrors krb5, but with different context SPIs */ -- iakerb_mechanism.gss_accept_sec_context = iakerb_gss_accept_sec_context; -- iakerb_mechanism.gss_init_sec_context = iakerb_gss_init_sec_context; -- iakerb_mechanism.gss_delete_sec_context = iakerb_gss_delete_sec_context; -- iakerb_mechanism.gss_acquire_cred = iakerb_gss_acquire_cred; -- iakerb_mechanism.gssspi_acquire_cred_with_password -- = iakerb_gss_acquire_cred_with_password; - - memset(&mech_iakerb, 0, sizeof(mech_iakerb)); - mech_iakerb.mech = &iakerb_mechanism; -diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c -index f30de32..4662bd9 100644 ---- a/src/lib/gssapi/krb5/iakerb.c -+++ b/src/lib/gssapi/krb5/iakerb.c -@@ -47,6 +47,8 @@ struct _iakerb_ctx_id_rec { - gss_ctx_id_t gssc; - krb5_data conv; /* conversation for checksumming */ - unsigned int count; /* number of round trips */ -+ int initiate; -+ int established; - krb5_get_init_creds_opt *gic_opts; - }; - -@@ -695,7 +697,7 @@ cleanup: - * Allocate and initialise an IAKERB context - */ - static krb5_error_code --iakerb_alloc_context(iakerb_ctx_id_t *pctx) -+iakerb_alloc_context(iakerb_ctx_id_t *pctx, int initiate) - { - iakerb_ctx_id_t ctx; - krb5_error_code code; -@@ -709,6 +711,8 @@ iakerb_alloc_context(iakerb_ctx_id_t *pctx) - ctx->magic = KG_IAKERB_CONTEXT; - ctx->state = IAKERB_AS_REQ; - ctx->count = 0; -+ ctx->initiate = initiate; -+ ctx->established = 0; - - code = krb5_gss_init_context(&ctx->k5c); - if (code != 0) -@@ -732,7 +736,7 @@ iakerb_gss_delete_sec_context(OM_uint32 *minor_status, - gss_ctx_id_t *context_handle, - gss_buffer_t output_token) - { -- OM_uint32 major_status = GSS_S_COMPLETE; -+ iakerb_ctx_id_t iakerb_ctx = (iakerb_ctx_id_t)*context_handle; - - if (output_token != GSS_C_NO_BUFFER) { - output_token->length = 0; -@@ -740,23 +744,10 @@ iakerb_gss_delete_sec_context(OM_uint32 *minor_status, - } - - *minor_status = 0; -+ *context_handle = GSS_C_NO_CONTEXT; -+ iakerb_release_context(iakerb_ctx); - -- if (*context_handle != GSS_C_NO_CONTEXT) { -- iakerb_ctx_id_t iakerb_ctx = (iakerb_ctx_id_t)*context_handle; -- -- if (iakerb_ctx->magic == KG_IAKERB_CONTEXT) { -- iakerb_release_context(iakerb_ctx); -- *context_handle = GSS_C_NO_CONTEXT; -- } else { -- assert(iakerb_ctx->magic == KG_CONTEXT); -- -- major_status = krb5_gss_delete_sec_context(minor_status, -- context_handle, -- output_token); -- } -- } -- -- return major_status; -+ return GSS_S_COMPLETE; - } - - static krb5_boolean -@@ -802,7 +793,7 @@ iakerb_gss_accept_sec_context(OM_uint32 *minor_status, - int initialContextToken = (*context_handle == GSS_C_NO_CONTEXT); - - if (initialContextToken) { -- code = iakerb_alloc_context(&ctx); -+ code = iakerb_alloc_context(&ctx, 0); - if (code != 0) - goto cleanup; - -@@ -854,11 +845,8 @@ iakerb_gss_accept_sec_context(OM_uint32 *minor_status, - time_rec, - delegated_cred_handle, - &exts); -- if (major_status == GSS_S_COMPLETE) { -- *context_handle = ctx->gssc; -- ctx->gssc = NULL; -- iakerb_release_context(ctx); -- } -+ if (major_status == GSS_S_COMPLETE) -+ ctx->established = 1; - if (mech_type != NULL) - *mech_type = (gss_OID)gss_mech_krb5; - } -@@ -897,7 +885,7 @@ iakerb_gss_init_sec_context(OM_uint32 *minor_status, - int initialContextToken = (*context_handle == GSS_C_NO_CONTEXT); - - if (initialContextToken) { -- code = iakerb_alloc_context(&ctx); -+ code = iakerb_alloc_context(&ctx, 1); - if (code != 0) { - *minor_status = code; - goto cleanup; -@@ -983,11 +971,8 @@ iakerb_gss_init_sec_context(OM_uint32 *minor_status, - ret_flags, - time_rec, - &exts); -- if (major_status == GSS_S_COMPLETE) { -- *context_handle = ctx->gssc; -- ctx->gssc = GSS_C_NO_CONTEXT; -- iakerb_release_context(ctx); -- } -+ if (major_status == GSS_S_COMPLETE) -+ ctx->established = 1; - if (actual_mech_type != NULL) - *actual_mech_type = (gss_OID)gss_mech_krb5; - } else { -@@ -1010,3 +995,309 @@ cleanup: - - return major_status; - } -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_buffer_t input_message_buffer, -+ gss_buffer_t output_message_buffer, int *conf_state, -+ gss_qop_t *qop_state) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_unwrap(minor_status, ctx->gssc, input_message_buffer, -+ output_message_buffer, conf_state, qop_state); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int conf_req_flag, gss_qop_t qop_req, -+ gss_buffer_t input_message_buffer, int *conf_state, -+ gss_buffer_t output_message_buffer) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_wrap(minor_status, ctx->gssc, conf_req_flag, qop_req, -+ input_message_buffer, conf_state, -+ output_message_buffer); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_process_context_token(OM_uint32 *minor_status, -+ const gss_ctx_id_t context_handle, -+ const gss_buffer_t token_buffer) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_DEFECTIVE_TOKEN; -+ -+ return krb5_gss_process_context_token(minor_status, ctx->gssc, -+ token_buffer); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ OM_uint32 *time_rec) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_context_time(minor_status, ctx->gssc, time_rec); -+} -+ -+#ifndef LEAN_CLIENT -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_export_sec_context(OM_uint32 *minor_status, -+ gss_ctx_id_t *context_handle, -+ gss_buffer_t interprocess_token) -+{ -+ OM_uint32 maj; -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ /* We don't currently support exporting partially established contexts. */ -+ if (!ctx->established) -+ return GSS_S_UNAVAILABLE; -+ -+ maj = krb5_gss_export_sec_context(minor_status, &ctx->gssc, -+ interprocess_token); -+ if (ctx->gssc == GSS_C_NO_CONTEXT) { -+ iakerb_release_context(ctx); -+ *context_handle = GSS_C_NO_CONTEXT; -+ } -+ return maj; -+} -+ -+/* -+ * Until we implement partial context exports, there are no SPNEGO exported -+ * context tokens, only tokens for the underlying krb5 context. So we do not -+ * need to implement an iakerb_gss_import_sec_context() yet; it would be -+ * unreachable except via a manually constructed token. -+ */ -+ -+#endif /* LEAN_CLIENT */ -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_inquire_context(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, gss_name_t *src_name, -+ gss_name_t *targ_name, OM_uint32 *lifetime_rec, -+ gss_OID *mech_type, OM_uint32 *ctx_flags, -+ int *initiate, int *opened) -+{ -+ OM_uint32 ret; -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (src_name != NULL) -+ *src_name = GSS_C_NO_NAME; -+ if (targ_name != NULL) -+ *targ_name = GSS_C_NO_NAME; -+ if (lifetime_rec != NULL) -+ *lifetime_rec = 0; -+ if (mech_type != NULL) -+ *mech_type = (gss_OID)gss_mech_iakerb; -+ if (ctx_flags != NULL) -+ *ctx_flags = 0; -+ if (initiate != NULL) -+ *initiate = ctx->initiate; -+ if (opened != NULL) -+ *opened = ctx->established; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_COMPLETE; -+ -+ ret = krb5_gss_inquire_context(minor_status, ctx->gssc, src_name, -+ targ_name, lifetime_rec, mech_type, -+ ctx_flags, initiate, opened); -+ -+ if (!ctx->established) { -+ /* Report IAKERB as the mech OID until the context is established. */ -+ if (mech_type != NULL) -+ *mech_type = (gss_OID)gss_mech_iakerb; -+ -+ /* We don't support exporting partially-established contexts. */ -+ if (ctx_flags != NULL) -+ *ctx_flags &= ~GSS_C_TRANS_FLAG; -+ } -+ -+ return ret; -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap_size_limit(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, int conf_req_flag, -+ gss_qop_t qop_req, OM_uint32 req_output_size, -+ OM_uint32 *max_input_size) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_wrap_size_limit(minor_status, ctx->gssc, conf_req_flag, -+ qop_req, req_output_size, max_input_size); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_qop_t qop_req, gss_buffer_t message_buffer, -+ gss_buffer_t message_token) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_get_mic(minor_status, ctx->gssc, qop_req, message_buffer, -+ message_token); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_buffer_t msg_buffer, gss_buffer_t token_buffer, -+ gss_qop_t *qop_state) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_verify_mic(minor_status, ctx->gssc, msg_buffer, -+ token_buffer, qop_state); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status, -+ const gss_ctx_id_t context_handle, -+ const gss_OID desired_object, -+ gss_buffer_set_t *data_set) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_UNAVAILABLE; -+ -+ return krb5_gss_inquire_sec_context_by_oid(minor_status, ctx->gssc, -+ desired_object, data_set); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_set_sec_context_option(OM_uint32 *minor_status, -+ gss_ctx_id_t *context_handle, -+ const gss_OID desired_object, -+ const gss_buffer_t value) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle; -+ -+ if (ctx == NULL || ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_UNAVAILABLE; -+ -+ return krb5_gss_set_sec_context_option(minor_status, &ctx->gssc, -+ desired_object, value); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int conf_req_flag, gss_qop_t qop_req, int *conf_state, -+ gss_iov_buffer_desc *iov, int iov_count) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_wrap_iov(minor_status, ctx->gssc, conf_req_flag, qop_req, -+ conf_state, iov, iov_count); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int *conf_state, gss_qop_t *qop_state, -+ gss_iov_buffer_desc *iov, int iov_count) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_unwrap_iov(minor_status, ctx->gssc, conf_state, qop_state, -+ iov, iov_count); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_wrap_iov_length(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, int conf_req_flag, -+ gss_qop_t qop_req, int *conf_state, -+ gss_iov_buffer_desc *iov, int iov_count) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_wrap_iov_length(minor_status, ctx->gssc, conf_req_flag, -+ qop_req, conf_state, iov, iov_count); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ int prf_key, const gss_buffer_t prf_in, -+ ssize_t desired_output_len, gss_buffer_t prf_out) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_pseudo_random(minor_status, ctx->gssc, prf_key, prf_in, -+ desired_output_len, prf_out); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_qop_t qop_req, gss_iov_buffer_desc *iov, -+ int iov_count) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_get_mic_iov(minor_status, ctx->gssc, qop_req, iov, -+ iov_count); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, -+ gss_qop_t *qop_state, gss_iov_buffer_desc *iov, -+ int iov_count) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_verify_mic_iov(minor_status, ctx->gssc, qop_state, iov, -+ iov_count); -+} -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status, -+ gss_ctx_id_t context_handle, gss_qop_t qop_req, -+ gss_iov_buffer_desc *iov, int iov_count) -+{ -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ -+ if (ctx->gssc == GSS_C_NO_CONTEXT) -+ return GSS_S_NO_CONTEXT; -+ -+ return krb5_gss_get_mic_iov_length(minor_status, ctx->gssc, qop_req, iov, -+ iov_count); -+} --- -2.6.2 - diff --git a/0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch b/0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch deleted file mode 100644 index f340802..0000000 --- a/0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch +++ /dev/null @@ -1,563 +0,0 @@ -From b51b33f2bc5d1497ddf5bd107f791c101695000d Mon Sep 17 00:00:00 2001 -From: Nicolas Williams -Date: Mon, 14 Sep 2015 12:27:52 -0400 -Subject: [PATCH] Fix SPNEGO context aliasing bugs [CVE-2015-2695] - -The SPNEGO mechanism currently replaces its context handle with the -mechanism context handle upon establishment, under the assumption that -most GSS functions are only called after context establishment. This -assumption is incorrect, and can lead to aliasing violations for some -programs. Maintain the SPNEGO context structure after context -establishment and refer to it in all GSS methods. Add initiate and -opened flags to the SPNEGO context structure for use in -gss_inquire_context() prior to context establishment. - -CVE-2015-2695: - -In MIT krb5 1.5 and later, applications which call -gss_inquire_context() on a partially-established SPNEGO context can -cause the GSS-API library to read from a pointer using the wrong type, -generally causing a process crash. This bug may go unnoticed, because -the most common SPNEGO authentication scenario establishes the context -after just one call to gss_accept_sec_context(). Java server -applications using the native JGSS provider are vulnerable to this -bug. A carefully crafted SPNEGO packet might allow the -gss_inquire_context() call to succeed with attacker-determined -results, but applications should not make access control decisions -based on gss_inquire_context() results prior to context establishment. - - CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C - -[ghudson@mit.edu: several bugfixes, style changes, and edge-case -behavior changes; commit message and CVE description] - -ticket: 8244 -target_version: 1.14 -tags: pullup - -diff --git a/src/lib/gssapi/spnego/gssapiP_spnego.h b/src/lib/gssapi/spnego/gssapiP_spnego.h -index 57372de..5c82764 100644 ---- a/src/lib/gssapi/spnego/gssapiP_spnego.h -+++ b/src/lib/gssapi/spnego/gssapiP_spnego.h -@@ -103,6 +103,8 @@ typedef struct { - int firstpass; - int mech_complete; - int nego_done; -+ int initiate; -+ int opened; - OM_uint32 ctx_flags; - gss_name_t internal_name; - gss_OID actual_mech; -diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c -index ef76e1f..7849c85 100644 ---- a/src/lib/gssapi/spnego/spnego_mech.c -+++ b/src/lib/gssapi/spnego/spnego_mech.c -@@ -102,7 +102,7 @@ static OM_uint32 get_negotiable_mechs(OM_uint32 *, spnego_gss_cred_id_t, - gss_cred_usage_t, gss_OID_set *); - static void release_spnego_ctx(spnego_gss_ctx_id_t *); - static void check_spnego_options(spnego_gss_ctx_id_t); --static spnego_gss_ctx_id_t create_spnego_ctx(void); -+static spnego_gss_ctx_id_t create_spnego_ctx(int); - static int put_mech_set(gss_OID_set mechSet, gss_buffer_t buf); - static int put_input_token(unsigned char **, gss_buffer_t, unsigned int); - static int put_mech_oid(unsigned char **, gss_OID_const, unsigned int); -@@ -454,7 +454,7 @@ check_spnego_options(spnego_gss_ctx_id_t spnego_ctx) - } - - static spnego_gss_ctx_id_t --create_spnego_ctx(void) -+create_spnego_ctx(int initiate) - { - spnego_gss_ctx_id_t spnego_ctx = NULL; - spnego_ctx = (spnego_gss_ctx_id_t) -@@ -477,6 +477,8 @@ create_spnego_ctx(void) - spnego_ctx->mic_rcvd = 0; - spnego_ctx->mech_complete = 0; - spnego_ctx->nego_done = 0; -+ spnego_ctx->opened = 0; -+ spnego_ctx->initiate = initiate; - spnego_ctx->internal_name = GSS_C_NO_NAME; - spnego_ctx->actual_mech = GSS_C_NO_OID; - -@@ -642,7 +644,7 @@ init_ctx_new(OM_uint32 *minor_status, - OM_uint32 ret; - spnego_gss_ctx_id_t sc = NULL; - -- sc = create_spnego_ctx(); -+ sc = create_spnego_ctx(1); - if (sc == NULL) - return GSS_S_FAILURE; - -@@ -659,10 +661,7 @@ init_ctx_new(OM_uint32 *minor_status, - ret = GSS_S_FAILURE; - goto cleanup; - } -- /* -- * The actual context is not yet determined, set the output -- * context handle to refer to the spnego context itself. -- */ -+ - sc->ctx_handle = GSS_C_NO_CONTEXT; - *ctx = (gss_ctx_id_t)sc; - sc = NULL; -@@ -1108,16 +1107,11 @@ cleanup: - } - gss_release_buffer(&tmpmin, &mechtok_out); - if (ret == GSS_S_COMPLETE) { -- /* -- * Now, switch the output context to refer to the -- * negotiated mechanism's context. -- */ -- *context_handle = (gss_ctx_id_t)spnego_ctx->ctx_handle; -+ spnego_ctx->opened = 1; - if (actual_mech != NULL) - *actual_mech = spnego_ctx->actual_mech; - if (ret_flags != NULL) - *ret_flags = spnego_ctx->ctx_flags; -- release_spnego_ctx(&spnego_ctx); - } else if (ret != GSS_S_CONTINUE_NEEDED) { - if (spnego_ctx != NULL) { - gss_delete_sec_context(&tmpmin, -@@ -1285,7 +1279,7 @@ acc_ctx_hints(OM_uint32 *minor_status, - if (ret != GSS_S_COMPLETE) - goto cleanup; - -- sc = create_spnego_ctx(); -+ sc = create_spnego_ctx(0); - if (sc == NULL) { - ret = GSS_S_FAILURE; - goto cleanup; -@@ -1367,7 +1361,7 @@ acc_ctx_new(OM_uint32 *minor_status, - gss_release_buffer(&tmpmin, &sc->DER_mechTypes); - assert(mech_wanted != GSS_C_NO_OID); - } else -- sc = create_spnego_ctx(); -+ sc = create_spnego_ctx(0); - if (sc == NULL) { - ret = GSS_S_FAILURE; - *return_token = NO_TOKEN_SEND; -@@ -1750,13 +1744,12 @@ cleanup: - ret = GSS_S_FAILURE; - } - if (ret == GSS_S_COMPLETE) { -- *context_handle = (gss_ctx_id_t)sc->ctx_handle; -+ sc->opened = 1; - if (sc->internal_name != GSS_C_NO_NAME && - src_name != NULL) { - *src_name = sc->internal_name; - sc->internal_name = GSS_C_NO_NAME; - } -- release_spnego_ctx(&sc); - } else if (ret != GSS_S_CONTINUE_NEEDED) { - if (sc != NULL) { - gss_delete_sec_context(&tmpmin, &sc->ctx_handle, -@@ -2069,8 +2062,13 @@ spnego_gss_unwrap( - gss_qop_t *qop_state) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_unwrap(minor_status, -- context_handle, -+ sc->ctx_handle, - input_message_buffer, - output_message_buffer, - conf_state, -@@ -2090,8 +2088,13 @@ spnego_gss_wrap( - gss_buffer_t output_message_buffer) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_wrap(minor_status, -- context_handle, -+ sc->ctx_handle, - conf_req_flag, - qop_req, - input_message_buffer, -@@ -2108,8 +2111,14 @@ spnego_gss_process_context_token( - const gss_buffer_t token_buffer) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ /* SPNEGO doesn't have its own context tokens. */ -+ if (!sc->opened) -+ return (GSS_S_DEFECTIVE_TOKEN); -+ - ret = gss_process_context_token(minor_status, -- context_handle, -+ sc->ctx_handle, - token_buffer); - - return (ret); -@@ -2133,19 +2142,9 @@ spnego_gss_delete_sec_context( - if (*ctx == NULL) - return (GSS_S_COMPLETE); - -- /* -- * If this is still an SPNEGO mech, release it locally. -- */ -- if ((*ctx)->magic_num == SPNEGO_MAGIC_ID) { -- (void) gss_delete_sec_context(minor_status, -- &(*ctx)->ctx_handle, -- output_token); -- (void) release_spnego_ctx(ctx); -- } else { -- ret = gss_delete_sec_context(minor_status, -- context_handle, -- output_token); -- } -+ (void) gss_delete_sec_context(minor_status, &(*ctx)->ctx_handle, -+ output_token); -+ (void) release_spnego_ctx(ctx); - - return (ret); - } -@@ -2157,8 +2156,13 @@ spnego_gss_context_time( - OM_uint32 *time_rec) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_context_time(minor_status, -- context_handle, -+ sc->ctx_handle, - time_rec); - return (ret); - } -@@ -2170,9 +2174,20 @@ spnego_gss_export_sec_context( - gss_buffer_t interprocess_token) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = *(spnego_gss_ctx_id_t *)context_handle; -+ -+ /* We don't currently support exporting partially established -+ * contexts. */ -+ if (!sc->opened) -+ return GSS_S_UNAVAILABLE; -+ - ret = gss_export_sec_context(minor_status, -- context_handle, -+ &sc->ctx_handle, - interprocess_token); -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) { -+ release_spnego_ctx(&sc); -+ *context_handle = GSS_C_NO_CONTEXT; -+ } - return (ret); - } - -@@ -2182,11 +2197,12 @@ spnego_gss_import_sec_context( - const gss_buffer_t interprocess_token, - gss_ctx_id_t *context_handle) - { -- OM_uint32 ret; -- ret = gss_import_sec_context(minor_status, -- interprocess_token, -- context_handle); -- return (ret); -+ /* -+ * Until we implement partial context exports, there are no SPNEGO -+ * exported context tokens, only tokens for underlying mechs. So just -+ * return an error for now. -+ */ -+ return GSS_S_UNAVAILABLE; - } - #endif /* LEAN_CLIENT */ - -@@ -2203,16 +2219,48 @@ spnego_gss_inquire_context( - int *opened) - { - OM_uint32 ret = GSS_S_COMPLETE; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (src_name != NULL) -+ *src_name = GSS_C_NO_NAME; -+ if (targ_name != NULL) -+ *targ_name = GSS_C_NO_NAME; -+ if (lifetime_rec != NULL) -+ *lifetime_rec = 0; -+ if (mech_type != NULL) -+ *mech_type = (gss_OID)gss_mech_spnego; -+ if (ctx_flags != NULL) -+ *ctx_flags = 0; -+ if (locally_initiated != NULL) -+ *locally_initiated = sc->initiate; -+ if (opened != NULL) -+ *opened = sc->opened; -+ -+ if (sc->ctx_handle != GSS_C_NO_CONTEXT) { -+ ret = gss_inquire_context(minor_status, sc->ctx_handle, -+ src_name, targ_name, lifetime_rec, -+ mech_type, ctx_flags, NULL, NULL); -+ } - -- ret = gss_inquire_context(minor_status, -- context_handle, -- src_name, -- targ_name, -- lifetime_rec, -- mech_type, -- ctx_flags, -- locally_initiated, -- opened); -+ if (!sc->opened) { -+ /* -+ * We are still doing SPNEGO negotiation, so report SPNEGO as -+ * the OID. After negotiation is complete we will report the -+ * underlying mechanism OID. -+ */ -+ if (mech_type != NULL) -+ *mech_type = (gss_OID)gss_mech_spnego; -+ -+ /* -+ * Remove flags we don't support with partially-established -+ * contexts. (Change this to keep GSS_C_TRANS_FLAG if we add -+ * support for exporting partial SPNEGO contexts.) -+ */ -+ if (ctx_flags != NULL) { -+ *ctx_flags &= ~GSS_C_PROT_READY_FLAG; -+ *ctx_flags &= ~GSS_C_TRANS_FLAG; -+ } -+ } - - return (ret); - } -@@ -2227,8 +2275,13 @@ spnego_gss_wrap_size_limit( - OM_uint32 *max_input_size) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_wrap_size_limit(minor_status, -- context_handle, -+ sc->ctx_handle, - conf_req_flag, - qop_req, - req_output_size, -@@ -2245,8 +2298,13 @@ spnego_gss_get_mic( - gss_buffer_t message_token) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_get_mic(minor_status, -- context_handle, -+ sc->ctx_handle, - qop_req, - message_buffer, - message_token); -@@ -2262,8 +2320,13 @@ spnego_gss_verify_mic( - gss_qop_t *qop_state) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_verify_mic(minor_status, -- context_handle, -+ sc->ctx_handle, - msg_buffer, - token_buffer, - qop_state); -@@ -2278,8 +2341,14 @@ spnego_gss_inquire_sec_context_by_oid( - gss_buffer_set_t *data_set) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ /* There are no SPNEGO-specific OIDs for this function. */ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_UNAVAILABLE); -+ - ret = gss_inquire_sec_context_by_oid(minor_status, -- context_handle, -+ sc->ctx_handle, - desired_object, - data_set); - return (ret); -@@ -2359,8 +2428,15 @@ spnego_gss_set_sec_context_option( - const gss_buffer_t value) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)*context_handle; -+ -+ /* There are no SPNEGO-specific OIDs for this function, and we cannot -+ * construct an empty SPNEGO context with it. */ -+ if (sc == NULL || sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_UNAVAILABLE); -+ - ret = gss_set_sec_context_option(minor_status, -- context_handle, -+ &sc->ctx_handle, - desired_object, - value); - return (ret); -@@ -2377,8 +2453,13 @@ spnego_gss_wrap_aead(OM_uint32 *minor_status, - gss_buffer_t output_message_buffer) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_wrap_aead(minor_status, -- context_handle, -+ sc->ctx_handle, - conf_req_flag, - qop_req, - input_assoc_buffer, -@@ -2399,8 +2480,13 @@ spnego_gss_unwrap_aead(OM_uint32 *minor_status, - gss_qop_t *qop_state) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_unwrap_aead(minor_status, -- context_handle, -+ sc->ctx_handle, - input_message_buffer, - input_assoc_buffer, - output_payload_buffer, -@@ -2419,8 +2505,13 @@ spnego_gss_wrap_iov(OM_uint32 *minor_status, - int iov_count) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_wrap_iov(minor_status, -- context_handle, -+ sc->ctx_handle, - conf_req_flag, - qop_req, - conf_state, -@@ -2438,8 +2529,13 @@ spnego_gss_unwrap_iov(OM_uint32 *minor_status, - int iov_count) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_unwrap_iov(minor_status, -- context_handle, -+ sc->ctx_handle, - conf_state, - qop_state, - iov, -@@ -2457,8 +2553,13 @@ spnego_gss_wrap_iov_length(OM_uint32 *minor_status, - int iov_count) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_wrap_iov_length(minor_status, -- context_handle, -+ sc->ctx_handle, - conf_req_flag, - qop_req, - conf_state, -@@ -2475,8 +2576,13 @@ spnego_gss_complete_auth_token( - gss_buffer_t input_message_buffer) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_UNAVAILABLE); -+ - ret = gss_complete_auth_token(minor_status, -- context_handle, -+ sc->ctx_handle, - input_message_buffer); - return (ret); - } -@@ -2721,8 +2827,13 @@ spnego_gss_pseudo_random(OM_uint32 *minor_status, - gss_buffer_t prf_out) - { - OM_uint32 ret; -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ - ret = gss_pseudo_random(minor_status, -- context, -+ sc->ctx_handle, - prf_key, - prf_in, - desired_output_len, -@@ -2863,7 +2974,12 @@ spnego_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, - gss_qop_t qop_req, gss_iov_buffer_desc *iov, - int iov_count) - { -- return gss_get_mic_iov(minor_status, context_handle, qop_req, iov, -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ -+ return gss_get_mic_iov(minor_status, sc->ctx_handle, qop_req, iov, - iov_count); - } - -@@ -2872,7 +2988,12 @@ spnego_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, - gss_qop_t *qop_state, gss_iov_buffer_desc *iov, - int iov_count) - { -- return gss_verify_mic_iov(minor_status, context_handle, qop_state, iov, -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ -+ return gss_verify_mic_iov(minor_status, sc->ctx_handle, qop_state, iov, - iov_count); - } - -@@ -2881,7 +3002,12 @@ spnego_gss_get_mic_iov_length(OM_uint32 *minor_status, - gss_ctx_id_t context_handle, gss_qop_t qop_req, - gss_iov_buffer_desc *iov, int iov_count) - { -- return gss_get_mic_iov_length(minor_status, context_handle, qop_req, iov, -+ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; -+ -+ if (sc->ctx_handle == GSS_C_NO_CONTEXT) -+ return (GSS_S_NO_CONTEXT); -+ -+ return gss_get_mic_iov_length(minor_status, sc->ctx_handle, qop_req, iov, - iov_count); - } - --- -2.6.2 - diff --git a/0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch b/0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch deleted file mode 100644 index 011a972..0000000 --- a/0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch +++ /dev/null @@ -1,120 +0,0 @@ -From 3db8dfec1ef50ddd78d6ba9503185995876a39fd Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Sun, 1 Nov 2015 22:45:21 -0500 -Subject: [PATCH] Fix IAKERB context export/import [CVE-2015-2698] - -The patches for CVE-2015-2696 contained a regression in the newly -added IAKERB iakerb_gss_export_sec_context() function, which could -cause it to corrupt memory. Fix the regression by properly -dereferencing the context_handle pointer before casting it. - -Also, the patches did not implement an IAKERB gss_import_sec_context() -function, under the erroneous belief that an exported IAKERB context -would be tagged as a krb5 context. Implement it now to allow IAKERB -contexts to be successfully exported and imported after establishment. - -CVE-2015-2698: - -In any MIT krb5 release with the patches for CVE-2015-2696 applied, an -application which calls gss_export_sec_context() may experience memory -corruption if the context was established using the IAKERB mechanism. -Historically, some vulnerabilities of this nature can be translated -into remote code execution, though the necessary exploits must be -tailored to the individual application and are usually quite -complicated. - - CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C - -ticket: 8273 (new) -target_version: 1.14 -tags: pullup - -Line numbers are slightly adjusted by Howard Guo . - -diff -rupN krb5-1.12.1/src/lib/gssapi/krb5/gssapi_krb5.c krb5-1.12.1-patched/src/lib/gssapi/krb5/gssapi_krb5.c ---- krb5-1.12.1/src/lib/gssapi/krb5/gssapi_krb5.c 2015-11-10 15:37:32.209657599 +0100 -+++ krb5-1.12.1-patched/src/lib/gssapi/krb5/gssapi_krb5.c 2015-11-10 15:38:52.106323672 +0100 -@@ -945,7 +945,7 @@ static struct gss_config iakerb_mechanis - NULL, - #else - iakerb_gss_export_sec_context, -- NULL, -+ iakerb_gss_import_sec_context, - #endif - krb5_gss_inquire_cred_by_mech, - krb5_gss_inquire_names_for_mech, -diff -rupN krb5-1.12.1/src/lib/gssapi/krb5/gssapiP_krb5.h krb5-1.12.1-patched/src/lib/gssapi/krb5/gssapiP_krb5.h ---- krb5-1.12.1/src/lib/gssapi/krb5/gssapiP_krb5.h 2015-11-10 15:37:32.209657599 +0100 -+++ krb5-1.12.1-patched/src/lib/gssapi/krb5/gssapiP_krb5.h 2015-11-10 15:38:52.106323672 +0100 -@@ -1393,6 +1393,11 @@ OM_uint32 KRB5_CALLCONV - iakerb_gss_export_sec_context(OM_uint32 *minor_status, - gss_ctx_id_t *context_handle, - gss_buffer_t interprocess_token); -+ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_import_sec_context(OM_uint32 *minor_status, -+ const gss_buffer_t interprocess_token, -+ gss_ctx_id_t *context_handle); - #endif /* LEAN_CLIENT */ - - OM_uint32 KRB5_CALLCONV -diff -rupN krb5-1.12.1/src/lib/gssapi/krb5/iakerb.c krb5-1.12.1-patched/src/lib/gssapi/krb5/iakerb.c ---- krb5-1.12.1/src/lib/gssapi/krb5/iakerb.c 2015-11-10 15:37:32.209657599 +0100 -+++ krb5-1.12.1-patched/src/lib/gssapi/krb5/iakerb.c 2015-11-10 15:41:43.431752632 +0100 -@@ -1061,7 +1061,7 @@ iakerb_gss_export_sec_context(OM_uint32 - gss_buffer_t interprocess_token) - { - OM_uint32 maj; -- iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; -+ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle; - - /* We don't currently support exporting partially established contexts. */ - if (!ctx->established) -@@ -1076,12 +1076,41 @@ iakerb_gss_export_sec_context(OM_uint32 - return maj; - } - --/* -- * Until we implement partial context exports, there are no SPNEGO exported -- * context tokens, only tokens for the underlying krb5 context. So we do not -- * need to implement an iakerb_gss_import_sec_context() yet; it would be -- * unreachable except via a manually constructed token. -- */ -+OM_uint32 KRB5_CALLCONV -+iakerb_gss_import_sec_context(OM_uint32 *minor_status, -+ gss_buffer_t interprocess_token, -+ gss_ctx_id_t *context_handle) -+{ -+ OM_uint32 maj, tmpmin; -+ krb5_error_code code; -+ gss_ctx_id_t gssc; -+ krb5_gss_ctx_id_t kctx; -+ iakerb_ctx_id_t ctx; -+ -+ maj = krb5_gss_import_sec_context(minor_status, interprocess_token, &gssc); -+ if (maj != GSS_S_COMPLETE) -+ return maj; -+ kctx = (krb5_gss_ctx_id_t)gssc; -+ -+ if (!kctx->established) { -+ /* We don't currently support importing partially established -+ * contexts. */ -+ krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER); -+ return GSS_S_FAILURE; -+ } -+ -+ code = iakerb_alloc_context(&ctx, kctx->initiate); -+ if (code != 0) { -+ krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER); -+ *minor_status = code; -+ return GSS_S_FAILURE; -+ } -+ -+ ctx->gssc = gssc; -+ ctx->established = 1; -+ *context_handle = (gss_ctx_id_t)ctx; -+ return GSS_S_COMPLETE; -+} - - #endif /* LEAN_CLIENT */ - diff --git a/krb5-1.13.2.tar.gz b/krb5-1.13.2.tar.gz deleted file mode 100644 index ceaf953..0000000 --- a/krb5-1.13.2.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:0221413cd170aaf144668c00805004fc2809823dbdbd1d9f27f95e23b79a259e -size 12104946 diff --git a/krb5-1.13.2.tar.gz.asc b/krb5-1.13.2.tar.gz.asc deleted file mode 100644 index d16e5d8..0000000 --- a/krb5-1.13.2.tar.gz.asc +++ /dev/null @@ -1,14 +0,0 @@ ------BEGIN PGP SIGNATURE----- -Version: GnuPG v1 - -iQGcBAABAgAGBQJVTUldAAoJEKMvF/0AVcMF9IoMAIEawAFZ1pRw91oRN6c3eAxy -RYBuJWsEa73JtqKCRtz7LA3qgacnJ8FGTpXaGHB3zErO55+Bclo1KZsUoNDtT27O -bxjsptPBjp15zTZhavlIpAjANFmo6QpghUHpLNcLxH8pXgmQDztHnPaenStxF8Bv -P2oFKh31uY3gYzOKnYi/r14XKSTNpFiDiGty53KY61efAO4H7xRFMhBgN2Vv1pBm -FvekjCWRypN7ai2z+94cuVNIlu8eipDnU4oBb865fRKlflxCdpBmHLr1K5AgwSEb -OAvDUPAEV9GwBP94M0yAoPwGf5ZHPvdORXbHfX00lzX2SgV+9DH4BqJOnytOeuaT -PA1Z+7izF+Xja4iHMcYlyJ7a/sGWachlZrw2ifELlYUf4vtcPY5e6gH0hSMUoA7t -Ww18ryv5fPHT1l+/o2P03hzZSFllOXjVsComsfw6Ws7qzbFuigpiVYdBg1XKMi9L -kjA7j43FTHvVKjtrEubiW+YHxowQHu5DIeQWVqsBJg== -=KdUH ------END PGP SIGNATURE----- diff --git a/krb5-1.13.3.tar.gz b/krb5-1.13.3.tar.gz new file mode 100644 index 0000000..b278aa9 --- /dev/null +++ b/krb5-1.13.3.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5d4af08ead9b7a1e9493cfd65e821234f151a46736e1ce586f886c8a8e65fabe +size 12133347 diff --git a/krb5-1.13.3.tar.gz.asc b/krb5-1.13.3.tar.gz.asc new file mode 100644 index 0000000..1d79d36 --- /dev/null +++ b/krb5-1.13.3.tar.gz.asc @@ -0,0 +1,14 @@ +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1 + +iQGcBAABAgAGBQJWYePPAAoJEKMvF/0AVcMFExYMAIJ4l6N0p00Gsh2smjTCrGcr +4ZemT6ovZW1bYhqKjnfeN1Csg0OEUKHUN20NRUuLhqOfDSU9UxJHXJ8azLTjopQr +yqe5teby2ki+cOcfcYbDUkRmLaG9wkrDiTIPV9SIObJCwuQfEhB4MMAw6hhMzLWZ +ENKqsGOxXrCCuDlcmHYgc7kRV2oa7ko72Lti70PpM3/mENGUHURz9tu/c8cratv8 +cJYLQibi7w1lA8qg2tKjqzwXJTLRfxm44cUOBWmD3Ph3XtfME7qmo56tYiiD2LIB +LiYBjipxWwK5LCTYb+2v1WMUcRamZ1J2JhzkNAwetocduuM3DRLCFcFlgTZS39n4 +AqIX7vmpbHljFY8IJ0UBfYTuR9+McfkXSKZN+QiQKr0BMNJbFPhjonSWkotXS39S +zyX2jDzBj5zXaBQ0aTL4w82XqIalIDWR9NXOPWggfSRcxMSiMSywl19eBAXk5Qfm +VGCb4CRB7CKBIsQbq2El5c2gTJP/lh/fnOqRfsvQXA== +=UvFL +-----END PGP SIGNATURE----- diff --git a/krb5-mini.changes b/krb5-mini.changes index 33657e3..a91e30f 100644 --- a/krb5-mini.changes +++ b/krb5-mini.changes @@ -1,3 +1,23 @@ +------------------------------------------------------------------- +Mon Dec 7 08:04:45 UTC 2015 - michael@stroeder.com + +- Udapte to 1.13.3 + +Major changes in 1.13.3 (2015-12-04) +==================================== + +This is a bug fix release. The krb5-1.13 release series is in +maintenance, and for new deployments, installers should prefer the +krb5-1.14 release series or later. + +* Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that + could cause server crashes. [CVE-2015-2695] [CVE-2015-2696] + [CVE-2015-2698] +* Fix build_principal memory bug that could cause a KDC + crash. [CVE-2015-2697] +* Allow an iprop slave to receive full resyncs from KDCs running + krb5-1.10 or earlier. + ------------------------------------------------------------------- Mon Jun 1 07:38:15 UTC 2015 - hguo@suse.com diff --git a/krb5-mini.spec b/krb5-mini.spec index bd60b34..cabfd91 100644 --- a/krb5-mini.spec +++ b/krb5-mini.spec @@ -17,7 +17,7 @@ %define build_mini 1 -%define srcRoot krb5-1.13.2 +%define srcRoot krb5-1.13.3 %define vendorFiles %{_builddir}/%{srcRoot}/vendor-files/ %define krb5docdir %{_defaultdocdir}/krb5 @@ -30,7 +30,7 @@ BuildRequires: keyutils-devel BuildRequires: libcom_err-devel BuildRequires: libselinux-devel BuildRequires: ncurses-devel -Version: 1.13.2 +Version: 1.13.3 Release: 0 Summary: MIT Kerberos5 Implementation--Libraries License: MIT diff --git a/krb5.changes b/krb5.changes index df8312f..94ec734 100644 --- a/krb5.changes +++ b/krb5.changes @@ -1,3 +1,28 @@ +------------------------------------------------------------------- +Mon Dec 7 08:04:45 UTC 2015 - michael@stroeder.com + +- Udapte to 1.13.3 +- removed patches for security fixes now in upstream source: + 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch + 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch + 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch + 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch + +Major changes in 1.13.3 (2015-12-04) +==================================== + +This is a bug fix release. The krb5-1.13 release series is in +maintenance, and for new deployments, installers should prefer the +krb5-1.14 release series or later. + +* Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that + could cause server crashes. [CVE-2015-2695] [CVE-2015-2696] + [CVE-2015-2698] +* Fix build_principal memory bug that could cause a KDC + crash. [CVE-2015-2697] +* Allow an iprop slave to receive full resyncs from KDCs running + krb5-1.10 or earlier. + ------------------------------------------------------------------- Tue Nov 10 14:57:01 UTC 2015 - hguo@suse.com diff --git a/krb5.spec b/krb5.spec index b66ff79..065286f 100644 --- a/krb5.spec +++ b/krb5.spec @@ -17,7 +17,7 @@ %define build_mini 0 -%define srcRoot krb5-1.13.2 +%define srcRoot krb5-1.13.3 %define vendorFiles %{_builddir}/%{srcRoot}/vendor-files/ %define krb5docdir %{_defaultdocdir}/krb5 @@ -30,7 +30,7 @@ BuildRequires: keyutils-devel BuildRequires: libcom_err-devel BuildRequires: libselinux-devel BuildRequires: ncurses-devel -Version: 1.13.2 +Version: 1.13.3 Release: 0 Summary: MIT Kerberos5 Implementation--Libraries License: MIT @@ -83,10 +83,6 @@ Patch11: krb5-1.12-ksu-path.patch Patch12: krb5-1.12-selinux-label.patch Patch13: krb5-1.9-debuginfo.patch Patch14: krb5-kvno-230379.patch -Patch100: 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch -Patch101: 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch -Patch102: 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch -Patch103: 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %fillup_prereq @@ -205,10 +201,6 @@ Include Files for Development %patch12 -p1 %patch13 -p0 %patch14 -p1 -%patch100 -p1 -%patch101 -p1 -%patch102 -p1 -%patch103 -p1 %build # needs to be re-generated