PT-2024-2632 · Unknown+9 · Kerberos 5+9

Lumingyin · Published 2024-02-26 · Updated 2026-05-27 · CVE-2024-26458

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Kerberos 5 (aka krb5) version 1.21.2

Description The issue is related to a memory leak in the implementation of the Kerberos network protocol, specifically in the /krb5/src/lib/rpc/pmap rmt.c component. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For Kerberos 5 (aka krb5) version 1.21.2, consider restricting access to the pmap rmt.c component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2024:3268

ALSA-2024:9331

AZL-35455

AZL-35479

BDU:2024-02699

CESA-2024_3268

CVE-2024-26458

ECHO-4897-A3E3-018C

INFSA-2024_3268

INFSA-2024_9331

MGASA-2024-0158

OPENSUSE-SU-2024:13921-1

RHSA-2024:3268

RHSA-2024:9331

RHSA-2024_3268

RHSA-2024_9331

RLSA-2024:3268

SUSE-SU-2024:0997-1

SUSE-SU-2024:0999-1

SUSE-SU-2024:1001-1

SUSE-SU-2024:1006-1

SUSE-SU-2024:1148-1

SUSE-SU-2024_0997-1

SUSE-SU-2024_0999-1

SUSE-SU-2024_1001-1

SUSE-SU-2024_1006-1

SUSE-SU-2024_1148-1

SUSE-SU-2025:20051-1

USN-7314-1

Affected Products

Almalinux

Centos

Debian

Kerberos 5

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 73

• 🔥 https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-26458 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-9331.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:9331 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-26458 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1006-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-3268.html · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-3268.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:3268 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0999-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-9331.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-24528 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26458 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory