MIT Kerberos 5 Integer Overflow Vulnerability in kdb_log.c Resizing Function Allows Out-of-Bounds Write and Daemon Crash

A vulnerability exists in MIT Kerberos 5 versions prior to 1.22 with incremental propagation enabled. An authenticated attacker can exploit an integer overflow caused by a large update size in the resize function of kdb_log.c. This overflow leads to an out-of-bounds write, potentially crashing the kadmind daemon.

Impact

Exploitation of this vulnerability causes a crash of the kadmind daemon.

Reproduction

To reproduce this vulnerability, an authenticated attacker can send a large update size to the kadmind daemon, which will trigger the integer overflow in the kdb_log.c resize function. This out-of-bounds write will likely cause the kadmind process to crash.

Remediation

Users can upgrade to MIT Kerberos 5 version 1.18.3-6+deb11u6 to address this vulnerability.