gss-proxy September 2026

gss-proxy@lists.fedorahosted.org

2 participants
3 discussions

[gssapi/gssproxy] 4d8d5d: gp_creds: fix use-after-free in gp_count_tickets()
by Simo Sorce 08 Sep '26

08 Sep '26

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 4d8d5de9568de22273b45213b32f5a7ff3121757 https://github.com/gssapi/gssproxy/commit/4d8d5de9568de22273b45213b32f5a7ff… Author: Prabhakar Pujeri <prabhakar.pujeri(a)dell.com> Date: 2026-09-08 (Tue, 08 Sep 2026) Changed paths: M src/gp_creds.c Log Message: ----------- gp_creds: fix use-after-free in gp_count_tickets() The original do-while pattern calls krb5_free_cred_contents() on the krb5_creds buffer even when krb5_cc_next_cred() reports KRB5_CC_END, i.e. after the iterator already returned without writing the buffer: the terminal iteration frees either freed or stale contents. Reshape as a while loop whose condition performs the iterator call so the body only runs on success, keep error handling after the loop, and terminate the cursor on the mid-iteration error path (the earlier goto-done skipped krb5_cc_end_seq_get, leaking the cursor). Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri(a)dell.com> To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications

1 0

[gssapi/gssproxy] 014302: Fix memory leak of remote context in gpp_remote_to...
by scottmayhew 01 Sep '26

01 Sep '26

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 014302f4d7d545fa40a7469bd366d74a27b7644f https://github.com/gssapi/gssproxy/commit/014302f4d7d545fa40a7469bd366d74a2… Author: Scott Mayhew <smayhew(a)redhat.com> Date: 2026-09-01 (Tue, 01 Sep 2026) Changed paths: M src/mechglue/gss_plugin.c Log Message: ----------- Fix memory leak of remote context in gpp_remote_to_local_ctx When converting a remote (gssproxy-side) context to a local one, gpp_remote_to_local_ctx() called xdr_free() on *remote_ctx to release the members of the gssx_ctx, but never free()'d the gssx_ctx struct itself before clearing the pointer. The struct is allocated by the XDR layer (gssrpc_xdr_reference) when decoding the init_sec_context reply, so this orphaned one gssx_ctx allocation on every conversion. This is hit on every successful sec=krb5 mount: gssd serializes the context for the kernel via gss_export_lucid_sec_context(), which the mechglue dispatches into gssi_inquire_sec_context_by_oid() -> gpp_remote_to_local_ctx(), leaking the remote context each time. Add the missing free(*remote_ctx), matching the xdr_free()+free() pattern already used in gpm_delete_sec_context(). This fixes the following leak: ==1043== 576 bytes in 2 blocks are definitely lost in loss record 815 of 926 ==1043== at 0x4877826: malloc (vg_replace_malloc.c:447) ==1043== by 0x5774BC1: gssrpc_xdr_reference (in /usr/lib64/libgssrpc.so.4.2) ==1043== by 0x5725E27: xdr_gssx_res_init_sec_context (gss_proxy_xdr.c:577) ==1043== by 0x5728512: gpm_make_call (gpm_common.c:768) ==1043== by 0x572BC83: gpm_init_sec_context (gpm_init_sec_context.c:94) ==1043== by 0x5731B83: gssi_init_sec_context (gpp_init_sec_context.c:158) ==1043== by 0x48F1C62: gss_init_sec_context (in /usr/lib64/libgssapi_krb5.so.2.2) ==1043== by 0x4A43DED: _rpc_gss_refresh (auth_gss.c:484) ==1043== by 0x4A44A79: rpc_gss_seccreate (auth_gss.c:861) ==1043== by 0x4010674: create_auth_rpc_client.constprop.0 (gssd_proc.c:439) ==1043== by 0x4012C03: krb5_use_machine_creds (gssd_proc.c:660) ==1043== by 0x4012C03: process_krb5_upcall (gssd_proc.c:789) ==1043== by 0x4012C03: gssd_work_thread_fn (gssd_proc.c:932) ==1043== by 0x4B649E1: start_thread (in /usr/lib64/libc.so.6) ==1043== Assisted-by: Claude Opus 4.8 <noreply(a)anthropic.com> Signed-off-by: Scott Mayhew <smayhew(a)redhat.com> To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications

1 0

[PATCH] Fix memory leak of remote context in gpp_remote_to_local_ctx
by Scott Mayhew 01 Sep '26

01 Sep '26

When converting a remote (gssproxy-side) context to a local one, gpp_remote_to_local_ctx() called xdr_free() on *remote_ctx to release the members of the gssx_ctx, but never free()'d the gssx_ctx struct itself before clearing the pointer. The struct is allocated by the XDR layer (gssrpc_xdr_reference) when decoding the init_sec_context reply, so this orphaned one gssx_ctx allocation on every conversion. This is hit on every successful sec=krb5 mount: gssd serializes the context for the kernel via gss_export_lucid_sec_context(), which the mechglue dispatches into gssi_inquire_sec_context_by_oid() -> gpp_remote_to_local_ctx(), leaking the remote context each time. Add the missing free(*remote_ctx), matching the xdr_free()+free() pattern already used in gpm_delete_sec_context(). This fixes the following leak: ==1043== 576 bytes in 2 blocks are definitely lost in loss record 815 of 926 ==1043== at 0x4877826: malloc (vg_replace_malloc.c:447) ==1043== by 0x5774BC1: gssrpc_xdr_reference (in /usr/lib64/libgssrpc.so.4.2) ==1043== by 0x5725E27: xdr_gssx_res_init_sec_context (gss_proxy_xdr.c:577) ==1043== by 0x5728512: gpm_make_call (gpm_common.c:768) ==1043== by 0x572BC83: gpm_init_sec_context (gpm_init_sec_context.c:94) ==1043== by 0x5731B83: gssi_init_sec_context (gpp_init_sec_context.c:158) ==1043== by 0x48F1C62: gss_init_sec_context (in /usr/lib64/libgssapi_krb5.so.2.2) ==1043== by 0x4A43DED: _rpc_gss_refresh (auth_gss.c:484) ==1043== by 0x4A44A79: rpc_gss_seccreate (auth_gss.c:861) ==1043== by 0x4010674: create_auth_rpc_client.constprop.0 (gssd_proc.c:439) ==1043== by 0x4012C03: krb5_use_machine_creds (gssd_proc.c:660) ==1043== by 0x4012C03: process_krb5_upcall (gssd_proc.c:789) ==1043== by 0x4012C03: gssd_work_thread_fn (gssd_proc.c:932) ==1043== by 0x4B649E1: start_thread (in /usr/lib64/libc.so.6) ==1043== Assisted-by: Claude Opus 4.8 <noreply(a)anthropic.com> Signed-off-by: Scott Mayhew <smayhew(a)redhat.com> --- src/mechglue/gss_plugin.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/mechglue/gss_plugin.c b/src/mechglue/gss_plugin.c index 0e423dd..4e2bc8f 100644 --- a/src/mechglue/gss_plugin.c +++ b/src/mechglue/gss_plugin.c @@ -525,6 +525,7 @@ uint32_t gpp_remote_to_local_ctx(uint32_t *minor, gssx_ctx **remote_ctx, free(mech.elements); (void)gss_release_buffer(&min, &wrap_token); xdr_free((xdrproc_t)xdr_gssx_ctx, (char *)(*remote_ctx)); + free(*remote_ctx); *remote_ctx = NULL; return maj; } -- 2.55.0

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

gss-proxy September 2026