PT-2024-1908 · Unknown+8 · Kerberos 5+8

Lumingyin · Published 2024-02-26 · Updated 2025-03-25 · CVE-2024-26462

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kerberos 5 (aka krb5) version 1.21.2

Description The issue is related to a memory leak in the /krb5/src/kdc/ndr.c component of the Kerberos 5 implementation. This memory leak vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Kerberos 5 (aka krb5) version 1.21.2, consider restricting access to the vulnerable component /krb5/src/kdc/ndr.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2024:9331

AZL-35480

BDU:2024-01687

CVE-2024-26462

ECHO-F677-6A69-33F8

INFSA-2024_9331

OPENSUSE-SU-2024:13921-1

RHSA-2024:9331

RHSA-2024_9331

SUSE-SU-2024:0997-1

SUSE-SU-2025:20051-1

USN-7314-1

Affected Products

Almalinux

Astra Linux

Debian

Kerberos 5

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

References · 50

• 🔥 https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:20051-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-26462 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01687 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-26462 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0997-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26462 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26462 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35480 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-9331.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26462 · Security Note
• https://ubuntu.com/security/notices/USN-7314-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-24528 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7314-1 · Vendor Advisory