CVE-2025-24528: 
Kerberos vulnerability analysis and mitigation

CVE-2025-24528 is an integer overflow vulnerability in MIT Kerberos 5 (krb5) affecting versions before 1.22 when incremental propagation is enabled. The flaw exists in the resize() function within kdb_log.c, where a large update size can trigger an integer overflow leading to an out-of-bounds write and crash of the kadmind daemon. The vulnerability was first disclosed via the Oracle Linux Bulletin on January 21, 2025, and formally received by NVD on January 16, 2026. It carries a CVSS v3.1 base score of 7.1 (High) as assigned by MITRE (Oracle Advisory, krb5 Commit).

The root cause is an integer overflow (CWE-190) in the resize() function in src/lib/kdb/kdb_log.c. When calculating the new block size for the incremental propagation (iprop) log file, the function fails to validate that the computed new_block value does not exceed UINT16_MAX (65535). An authenticated attacker can submit a specially crafted update with an excessively large size, causing the block size calculation to overflow and subsequently triggering an out-of-bounds write into the memory-mapped region of the iprop log file. The vulnerability has been present since MIT krb5 release 1.7 and is only exploitable when incremental propagation is enabled in the Kerberos configuration. The fix adds a bounds check that logs an error and returns KRB5_LOG_ERROR if new_block exceeds UINT16_MAX (krb5 Commit).

Successful exploitation allows an authenticated attacker to cause an out-of-bounds write in the kadmind process, most likely resulting in a daemon crash and denial of service of the Kerberos administration service. The scope is marked as Changed in the CVSS vector, indicating potential impact beyond the vulnerable component itself. While confidentiality impact is rated None, the integrity impact is rated Low and availability impact is rated High, meaning the primary risk is disruption of Kerberos authentication infrastructure, which could indirectly affect all services relying on Kerberos for authentication (Oracle Advisory, krb5 Commit).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to be authenticated and the target system to have incremental propagation (iprop) enabled, which is not a default configuration, raising the exploitation bar. The EPSS score is approximately 0.014% (0.000140), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, krb5 Commit).

1. Reconnaissance: Identify Kerberos environments running MIT krb5 versions before 1.22 with incremental propagation (iprop) enabled — this can be inferred from exposed KDC/kadmind service banners or configuration leaks.
2. Authentication: Obtain valid Kerberos credentials (e.g., a low-privileged principal) sufficient to interact with the kadmind service.
3. Craft malicious update: Construct a Kerberos database update request with an excessively large update size that, when processed by resize() in kdb_log.c, causes the new_block calculation to overflow beyond UINT16_MAX.
4. Submit update: Send the crafted update to the kadmind daemon via the iprop protocol, triggering the integer overflow in resize().
5. Trigger out-of-bounds write: The overflowed block size causes kadmind to write beyond the end of the memory-mapped iprop log file region, likely resulting in a process crash (denial of service) (krb5 Commit).

• Logs: Syslog entries containing ulog overflow caused by principal <name> from the kadmind process (logged by the patched version; unpatched versions may show a crash without this message).
• Logs: Unexpected kadmind process termination or crash entries in system logs (e.g., /var/log/krb5kdc.log, /var/log/messages, or journalctl).
• Process: Sudden disappearance or restart of the kadmind daemon process without administrative action.
• Network: Unusual or malformed iprop protocol traffic directed at the kadmind port (typically TCP 749) from authenticated but unexpected sources.

The primary remediation is to upgrade MIT krb5 to version 1.22 or later, which includes the fix that adds a bounds check preventing the overflow in resize(). Downstream Linux distributions have released patched packages: Red Hat (RHSA-2025:1352, RHSA-2025:2722, and later), SUSE (SUSE-2025-0343-1, SUSE-2025-0351-1, SUSE-2025-0822-1), Fedora (krb5-2025-3e5228ee23, krb5-2025-61b9344baf), Debian LTS (February 2025 announcement), Ubuntu (USN-7314-1), and Oracle Linux (ELSA-2025-1352). As a workaround, disabling incremental propagation (iprop) in the Kerberos configuration eliminates the attack surface entirely, since the vulnerability is only exploitable when iprop is enabled (Red Hat Errata, Debian LTS, Oracle Advisory).

The vulnerability received moderate attention from the Linux security community, primarily through distribution security advisories from Red Hat, SUSE, Fedora, Debian, Ubuntu, Oracle, and Mageia. Coverage was largely limited to patch announcement aggregators and Linux security news sites. No notable independent researcher commentary or significant social media discussion has been identified beyond routine patch tracking (Oracle Advisory, Red Hat Errata).