CVE-2021-36222: 
MySQL vulnerability analysis and mitigation

The vulnerability (CVE-2021-36222) affects MIT Kerberos 5 (krb5) versions prior to 1.18.4 and 1.19.x before 1.19.2. The issue exists in the Key Distribution Center (KDC) component, specifically in the ec_verify function in kdc/kdc_preauth_ec.c. This vulnerability was discovered and disclosed in July 2021 (Debian Security).

The vulnerability stems from a NULL pointer dereference in the KDC's handling of PA-ENCRYPTED-CHALLENGE padata elements. The ec_verify() function contains a check to avoid further processing if the armor key is NULL, but this check is bypassed by a call to k5memdup0() which overwrites the return value if the allocation succeeds. If the armor key is NULL, a subsequent call to krb5_c_fx_cf2_simple() will dereference it, resulting in a crash (GitHub Commit). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

When successfully exploited, this vulnerability allows an unauthenticated attacker to cause a denial of service (DoS) condition by crashing the KDC service. The impact is limited to service availability, with no direct impact on confidentiality or integrity (NetApp Advisory).

The vulnerability can be exploited remotely by an unauthenticated attacker by sending a specially crafted request containing a PA-ENCRYPTED-CHALLENGE padata element without using FAST to the KDC (Debian Security).

The vulnerability has been fixed in MIT Kerberos 5 versions 1.18.4 and 1.19.2. For Debian systems, the fix has been backported to version 1.17-3+deb10u2 for the stable (buster) distribution. Organizations are strongly recommended to upgrade their krb5 packages to the patched versions (Debian Security).