CVE-2023-25564 GSS-NTLMSSP vulnerable to memory corruption when decoding UTF16 strings

2023-02-1417:35:26

CWE-787

GitHub_M

www.cve.org

gss-ntlmssp

memory corruption

utf16

vulnerability

denial of service

out-of-bounds write

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

45.8%

JSON

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable outlen was not initialized and could cause writing a zero to an arbitrary place in memory if ntlm_str_convert() were to fail, which would leave outlen uninitialized. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the main gss_accept_sec_context entry point. This issue is fixed in version 1.2.0.

CNA Affected

[
  {
    "vendor": "gssapi",
    "product": "gss-ntlmssp",
    "versions": [
      {
        "version": "< 1.2.0",
        "status": "affected"
      }
    ]
  }
]