Fix double-free in KDC TGS processing (CVE-2023-39975)

Signed-off-by: Julien Rische <jrische@redhat.com>

0014-Fix-double-free-in-KDC-TGS-processing.patch

@@ -0,0 +1,48 @@
+From 0e609dc74037e680e0e5d7ec6418b5c296161e8e Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Fri, 4 Aug 2023 09:54:06 +0200
+Subject: [PATCH] Fix double-free in KDC TGS processing
+
+When issuing a ticket for a TGS renew or validate request, copy only
+the server field from the outer part of the header ticket to the new
+ticket.  Copying the whole structure causes the enc_part pointer to be
+aliased to the header ticket until krb5_encrypt_tkt_part() is called,
+resulting in a double-free if handle_authdata() fails.
+
+[ghudson@mit.edu: changed the fix to avoid aliasing enc_part rather
+than check for aliasing before freeing; rewrote commit message]
+
+CVE-2023-39975:
+
+In MIT krb5 release 1.21, an authenticated attacker can cause a KDC to
+free the same pointer twice if it can induce a failure in
+authorization data handling.
+
+ticket: 9101 (new)
+tags: pullup
+target_version: 1.21-next
+
+(cherry picked from commit 88a1701b423c13991a8064feeb26952d3641d840)
+---
+ src/kdc/do_tgs_req.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
+index 6e4c8fa9f3..0acc45850f 100644
+--- a/src/kdc/do_tgs_req.c
++++ b/src/kdc/do_tgs_req.c
+@@ -1010,8 +1010,9 @@ tgs_issue_ticket(kdc_realm_t *realm, struct tgs_req_info *t,
+     }
+ 
+     if (t->req->kdc_options & (KDC_OPT_VALIDATE | KDC_OPT_RENEW)) {
+-        /* Copy the whole header ticket except for authorization data. */
+-        ticket_reply = *t->header_tkt;
++        /* Copy the header ticket server and all enc-part fields except for
++         * authorization data. */
++        ticket_reply.server = t->header_tkt->server;
+         enc_tkt_reply = *t->header_tkt->enc_part2;
+         enc_tkt_reply.authorization_data = NULL;
+     } else {
+-- 
+2.41.0
+

krb5.spec

@@ -10,7 +10,7 @@
 #
 # baserelease is what we have standardized across Fedora and what
 # rpmdev-bumpspec knows how to handle.
-%global baserelease 2
+%global baserelease 3
 
 # This should be e.g. beta1 or %%nil
 %global pre_release %nil
@@ -72,6 +72,7 @@ Patch0010: 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch
 Patch0011: 0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch
 Patch0012: 0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch
 Patch0013: 0013-Enable-PKINIT-if-at-least-one-group-is-available.patch
+Patch0014: 0014-Fix-double-free-in-KDC-TGS-processing.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -708,6 +709,9 @@ exit 0
 %{_datarootdir}/%{name}-tests/
 
 %changelog
+* Tue Aug 08 2023 Julien Rische <jrische@redhat.com> - 1.21-3
+- Fix double-free in KDC TGS processing (CVE-2023-39975)
+
 * Thu Jun 29 2023 Marek Blaha <mblaha@redhat.com> - 1.21-2
 - Replace file dependency with package name
   Resolves: rhbz#2216903