CVE-2025-24528

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

Security Fix(es):

In MIT krb5 release 1.7 and later with incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file, likely causing a process crash.(CVE-2025-24528)

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix:

• CVE-2025-24528 krb5: overflow when calculating ulog block size

Bug fix:

• kdb5_util: fix DB entry flags on modification

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

• krb5: overflow when calculating ulog block size (CVE-2025-24528)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix:

• CVE-2025-24528 krb5: overflow when calculating ulog block size

Bug fix:

• kdb5_util: fix DB entry flags on modification

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

• krb5: overflow when calculating ulog block size (CVE-2025-24528)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

• CVE-2025-24528: prevent overflow when calculating ulog block size

• CVE-2025-24528: prevent overflow when calculating ulog block size

• CVE-2025-24528: fix buffer overflow vulnerability in iprop log file writing

• CVE-2025-3576: prevent spoofing vulnerability in GSSAPI-protected messages using RC4-HMAC-MD5 due to weaknesses in MD5 checksum design
• CVE-2025-24528: prevent overflow when calculating ulog block size

• CVE-2025-24528: fix buffer overflow vulnerability in iprop log file writing

• CVE-2025-24528: prevent overflow when calculating ulog block size
• CVE-2025-3576: don't issue session keys with deprecated enctypes (RC4-HMAC-MD5 spoofing)
• CVE-2026-40355: fix NULL pointer dereference in NegoEx parse_nego_message
• CVE-2026-40356: fix integer underflow in NegoEx parse_message header_len
• CVE-2023-36054: ensure array count consistency in kadm5 RPC to prevent freeing uninitialized pointers in _xdr_kadm5_principal_ent_rec

Overflow when calculating ulog block size. (CVE-2025-24528)

These are all security issues fixed in the krb5-1.21.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for krb5 fixes the following issues:

• CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ulog block size can lead to process crash (bsc#1236619).

This update for krb5 fixes the following issues:

• CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ulog block size can lead to process crash (bsc#1236619).

This update for krb5 fixes the following issues:

• CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ulog block size can lead to process crash (bsc#1236619).

This update for crypto-policies and krb5 fixes the following issues:

Security issue fixed:

• CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ulog block size can lead to process crash (bsc#1236619).

Feature addition:

• Add crypto-policies support; (jsc#PED-12018)

  • The default krb5.conf has been updated to include config snippets in the krb5.conf.d directory, where crypto-policies drops its.

• Allow to use KRB5KDF in FIPS mode; (jsc#PED-12018);

  • This key derivation function is used by AES256-CTS-HMAC-SHA1-96 and AES128-CTS-HMAC-SHA1-96 encryption types, used by Active directory. If these encryption types are allowed or not in FIPS mode is enforced now by the FIPS:AD-SUPPORT subpolicy.

This update for krb5 fixes the following issues:

• CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ulog block size can lead to process crash (bsc#1236619).

This update for krb5 fixes the following issues:

• CVE-2025-24528: Prevent overflow when calculating ulog block size. An authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file, likely causing a process crash (bsc#1236619).

This update for krb5 fixes the following issues:

• CVE-2025-24528: Prevent overflow when calculating ulog block size. An authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file, likely causing a process crash; ((bsc#1236619).

It was discovered that Kerberos incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause Kerberos to consume memory,leading to a denial of service. (CVE-2024-26458, CVE-2024-26461)

It was discovered that Kerberos incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause Kerberos to consume memory,leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26462)

It was discovered that the Kerberos kadmind daemon incorrectly handled log files when incremental propagation was enabled. An authenticated attacker could use this issue to cause kadmind to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-24528)