CVE-2023-36054

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd	Patch
https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final	Patch
https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final	Patch
https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20230908-0004/	Third Party Advisory
https://web.mit.edu/kerberos/www/advisories/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mit:kerberos_5::::::::
	cpe:2.3:a:mit:kerberos_5:1.21:-::::::
	cpe:2.3:a:mit:kerberos_5:1.21:beta1::::::

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
	cpe:2.3:a:netapp:clustered_data_ontap:9.0:-::::::
	cpe:2.3:a:netapp:hci:-:::::::*
	cpe:2.3:a:netapp:management_services_for_element_software:-:::::::*
	cpe:2.3:a:netapp:ontap_tools:-:::::vmware_vsphere::

History

No history.

Information

Published : 2023-08-07 19:15

Updated : 2023-11-15 03:23

NVD link : CVE-2023-36054

Mitre link : CVE-2023-36054

CVE.ORG link : CVE-2023-36054

JSON object : View

Products Affected

netapp

hci
ontap_tools
clustered_data_ontap
active_iq_unified_manager
management_services_for_element_software

debian

debian_linux

mit

kerberos_5

CWE

CWE-824

Access of Uninitialized Pointer

{"id": "CVE-2023-36054", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-08-07T19:15:09.840", "references": [{"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20230908-0004/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://web.mit.edu/kerberos/www/advisories/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-824"}]}], "descriptions": [{"lang": "en", "value": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."}], "lastModified": "2023-11-15T03:23:27.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F862235-F5E3-46F0-8907-5521B79DD14D", "versionEndExcluding": "1.20.2"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.21:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77FA11D6-3074-412F-9008-A4F690C79133"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.21:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5096413B-6BEE-424A-A198-C01934E45000"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:9.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52DE3DFE-350F-4E83-B425-1D7D47BEF6DA"}, {"criteria": "cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A6E548F-62E9-40CB-85DA-FDAA0F0096C6"}, {"criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1"}, {"criteria": "cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "CBCC384C-5DF0-41AB-B17B-6E9B6CAE8065"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}