Bug 275915 - kadmin(d): adding principal crashes in ARCFOUR_string_to_key
Summary: kadmin(d): adding principal crashes in ARCFOUR_string_to_key
Status: Closed DUPLICATE of bug 272835
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 14.0-RELEASE
Hardware: Any Any
: --- Affects Only Me
Assignee: Cy Schubert
URL: https://github.com/freebsd/freebsd-sr...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-24 16:23 UTC by Lexi Winter
Modified: 2024-01-30 05:00 UTC (History)
3 users (show)

See Also:


Attachments
patch (590 bytes, patch)
2023-12-27 14:39 UTC, Lexi Winter
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Lexi Winter freebsd_committer freebsd_triage 2023-12-24 16:23:59 UTC
FreeBSD hemlock.eden.le-fay.org 14.0-RELEASE-p3 FreeBSD 14.0-RELEASE-p3 #5 releng/14.0-n265398-20fae1e16990: Fri Dec 15 22:12:51 GMT 2023     root@hemlock.eden.le-fay.org:/data/src/obj/data/src/releng/14.0/amd64.amd64/sys/HEMLOCK amd64

kadmin -l crashes in addprinc --random-key:

# gdb /usr/bin/kadmin
GNU gdb (GDB) 13.2 [GDB v13.2 for FreeBSD]
[...]
(gdb) run -l
Starting program: /usr/bin/kadmin -l
kadmin> add --random-key host/thyme.eden.le-fay.org
Max ticket life [1 day]:unlimited
Max renewable life [1 week]:unlimited
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:

Program received signal SIGSEGV, Segmentation fault.
Address not mapped to object.
0x0000000000000000 in ?? ()
(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x0000000801126e68 in ARCFOUR_string_to_key (context=0x80201a000, enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., opaque=..., key=0x802134958)
    at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt-arcfour.c:84
#2  0x0000000801127f97 in krb5_string_to_key_data_salt_opaque (enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, salt=..., opaque=..., context=<optimized out>, password=...,
    key=<optimized out>) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:201
#3  krb5_string_to_key_data_salt (context=0x80201a000, enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., key=0x802134958)
    at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:173
#4  0x000000080112817b in krb5_string_to_key_salt (context=0x80204be90, context@entry=0x80201a000, enctype=-13001, password=0x0, password@entry=0x7fffffffd1b0 "ys4tdErYgu",
    salt=..., key=0x4) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:225
#5  0x00000008010a93a5 in hdb_generate_key_set_password (context=0x80201a000, principal=<optimized out>, password=password@entry=0x7fffffffd1b0 "ys4tdErYgu",
    keys=keys@entry=0x7fffffffceb0, num_keys=num_keys@entry=0x7fffffffcea8) at /data/src/releng/14.0/crypto/heimdal/lib/hdb/keys.c:381
#6  0x00000008010939fa in _kadm5_set_keys (context=context@entry=0x80201a140, ent=ent@entry=0x7fffffffcef8, password=0x1 <error: Cannot access memory at address 0x1>,
    password@entry=0x7fffffffd1b0 "ys4tdErYgu") at /data/src/releng/14.0/crypto/heimdal/lib/kadm5/set_keys.c:51
#7  0x000000080108ea3c in kadm5_s_create_principal (server_handle=0x80201a140, princ=<optimized out>, mask=<optimized out>, password=0x7fffffffd1b0 "ys4tdErYgu")
    at /data/src/releng/14.0/crypto/heimdal/lib/kadm5/create_s.c:172
#8  0x000000000102b64b in add_one_principal (name=<optimized out>, rand_key=1, rand_password=0, use_defaults=0, password=0x7fffffffd1b0 "ys4tdErYgu", key_data=0x0,
    max_ticket_life=<optimized out>, max_renewable_life=<optimized out>, attributes=0x0, expiration=<optimized out>, pw_expiration=0x0)
    at /data/src/releng/14.0/crypto/heimdal/kadmin/ank.c:141
#9  add_new_key (opt=opt@entry=0x7fffffffd600, argc=argc@entry=1, argv=0x802049290, argv@entry=0x802049280) at /data/src/releng/14.0/crypto/heimdal/kadmin/ank.c:243
#10 0x000000000102f1ac in add_wrap (argc=<optimized out>, argv=0x802049280) at kadmin-commands.c:210
#11 0x00000000010349be in sl_command (cmds=<optimized out>, argc=3, argv=0x802049280) at /data/src/releng/14.0/crypto/heimdal/lib/sl/sl.c:209
#12 sl_command_loop (cmds=cmds@entry=0x10388b0 <commands>, prompt=prompt@entry=0x1026cca "kadmin> ", data=<optimized out>)
    at /data/src/releng/14.0/crypto/heimdal/lib/sl/sl.c:328
#13 0x000000000102e896 in main (argc=<optimized out>, argv=<optimized out>) at /data/src/releng/14.0/crypto/heimdal/kadmin/kadmin.c:275

(gdb) up
#1  0x0000000801126e68 in ARCFOUR_string_to_key (context=0x80201a000, enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., opaque=..., key=0x802134958)
    at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt-arcfour.c:84
84              EVP_DigestUpdate (m, &p, 1);

the same request in kadmin without -l causes kadmind to crash.

specifying a password instead of using --random-key also crashes.
Comment 1 Lexi Winter freebsd_committer freebsd_triage 2023-12-24 16:53:43 UTC
this seems to be caused by having arcfour-hmac-md5 in the kadmin default_keys list, which is present by default, along with OpenSSL's MD4 not working for some reason:

# openssl md4
Error setting digest
00206156FE410000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:/data/src/releng/14.0/crypto/openssl/crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (MD4 : 72), Properties ()
00206156FE410000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:/data/src/releng/14.0/crypto/openssl/crypto/evp/digest.c:254:

i fixed the problem by setting 'default_keys = aes256-cts-hmac-sha1-96:pw-salt' in krb5.conf, but this should probably report a useful error instead of crashing.

is a patch to fix the error reporting useful, or does this need to go to heimdal upstream first?
Comment 2 Lexi Winter freebsd_committer freebsd_triage 2023-12-27 14:39:10 UTC
Created attachment 247295 [details]
patch

well, this patch fixes the crash in kadmin/kadmind by returning an error instead:

kadmin> add -r host/test.example.org@EXAMPLE.ORG
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:
kadmin: kadm5_create_principal: Cannot create digest
kadmin: adding host/test.example.org@EXAMPLE.ORG: Cannot create digest
kadmin>

it doesn't fix the underlying issue with MD4 not being available. the default default_keys should probably be updated to remove arcfour-hmac-md5, since almost nothing requires this nowadays (including Windows).
Comment 3 Ivan 2024-01-11 17:51:56 UTC
*** Bug 276257 has been marked as a duplicate of this bug. ***
Comment 4 Ivan 2024-01-11 17:54:56 UTC
init DOMAIN.NAME segfaults as well. I was very confused since it's the first attempt to setup KDC.

I'm building gdb atm, so probably I'd repeated your analysis, but since I've found this before, thanks for your investigation!
Comment 5 Lexi Winter freebsd_committer freebsd_triage 2024-01-12 05:07:46 UTC
was your original crash with ports heimdal?  i thought that wouldn't be affected by this particular issue since it includes its own libhcrypto library which is supposed to replace the missing algorithms in OpenSSL 3.0 libcrypto.  i haven't tested that though.
Comment 6 Ivan 2024-01-12 09:08:07 UTC
Handbook doesn't mention that security/heimdal is optional and when it tells to install the port and invoke a kadmin, actually the base version is invoked.

kadmin from security/heimdal doesn't work as well, init DOMAIN.NAME complains about rc4 instantiation failure and exits.

security/krb5 works, but it far more complex software to setup. It even comes without rc.d scripts for some reason.
Comment 7 Cy Schubert freebsd_committer freebsd_triage 2024-01-30 04:50:55 UTC
I believe we fixed this in stable/14 with c7db2e15e4045e1daba939bb151fc5878f791c7b and 17e941a0c88cac2d8cd28d6614448adbd65d4b72. Can you try these, please?
Comment 8 Cy Schubert freebsd_committer freebsd_triage 2024-01-30 05:00:06 UTC

*** This bug has been marked as a duplicate of bug 272835 ***