Critical NULL Pointer Dereference in MIT Kerberos 5 (krb5) - CVE-2021-37750
Summary
ALPINE-CVE-2021-37750: The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. Affects krb5 versions < 1.18.5-r0. Fixed in 1.18.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MIT Kerberos 5 (krb5) is a widely used network authentication protocol designed to provide secure authentication for users and services. It enables secure communication over untrusted networks by using secret-key cryptography. The krb5 package is integral to many systems, providing essential authentication services. However, it is susceptible to vulnerabilities that can compromise its security, such as the one identified in CVE-2021-37750.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the Key Distribution Center (KDC) component of MIT Kerberos 5. This issue occurs in the file kdc/do_tgs_req.c when processing a FAST inner body that lacks a server field. If exploited, this vulnerability can lead to a denial of service (DoS) condition, potentially causing the KDC to crash. The vulnerability affects versions of krb5 prior to 1.18.5 and 1.19.x before 1.19.3, making it critical for users to update to the patched versions to mitigate risks.
How To Fix
Minimum fixed version
1.18.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the KDC service temporarily until the update can be applied. This can be done by stopping the service with the command: 'service krb5-kdc stop'.
Conclusion
CVE-2021-37750 represents a significant vulnerability in the MIT Kerberos 5 authentication protocol, necessitating prompt action from users to update to the patched versions. By following the outlined steps to fix the vulnerability and considering workarounds, users can protect their systems from potential exploitation.
See every vulnerability recorded for krb5 →
FAQ
CVE-2021-37750 is a vulnerability in MIT Kerberos 5 that allows for a NULL pointer dereference, potentially leading to a denial of service.
Versions of krb5 prior to 1.18.5 and 1.19.x before 1.19.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-37750 is 6.5, indicating a medium severity level.
If you cannot update immediately, consider stopping the KDC service to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
