From fc773115fa2dbb6c01377f2ed47dabf79a4e361a Mon Sep 17 00:00:00 2001 From: Cy Schubert Date: Thu, 15 Feb 2024 07:41:07 -0800 Subject: [PATCH] heimdal: Fix NULL deref MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A flawed logical condition allows a malicious actor to remotely trigger a NULL pointer dereference using a crafted negTokenInit token. Upstream notes: Reported to Heimdal by Michał Kępień . From the report: Acknowledgement --------------- This flaw was found while working on addressing ZDI-CAN-12302: ISC BIND TKEY Query Heap-based Buffer Overflow Remote Code Execution Vulnerability, which was reported to ISC by Trend Micro's Zero Day Security: CVE-2022-3116 Obtained from: upstream 7a19658c1 MFC after: 1 week --- crypto/heimdal/lib/gssapi/spnego/accept_sec_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/heimdal/lib/gssapi/spnego/accept_sec_context.c b/crypto/heimdal/lib/gssapi/spnego/accept_sec_context.c index b60dc19ad8e..48542f06fcb 100644 --- a/crypto/heimdal/lib/gssapi/spnego/accept_sec_context.c +++ b/crypto/heimdal/lib/gssapi/spnego/accept_sec_context.c @@ -605,7 +605,7 @@ acceptor_start * If opportunistic token failed, lets try the other mechs. */ - if (!first_ok && ni->mechToken != NULL) { + if (!first_ok) { size_t j; preferred_mech_type = GSS_C_NO_OID;