Memory Leak in gss-ntlmssp NTLM Authentication

Executive Summary

This vulnerability is a memory leak in the gss-ntlmssp library during NTLM authentication. When a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries, the parser allocates memory for each string but fails to free previous allocations for the same AV_PAIR type. This causes gradual memory exhaustion on the client, leading to a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for memory exhaustion during NTLM authentication. Check for repeated NTLM authentication attempts or unusual memory usage patterns in gss-ntlmssp processes. Use system monitoring tools like top, htop, or ps to observe memory consumption by gss-ntlmssp clients during authentication.

Useful 0 Not Useful 0

Impact Analysis

If you are a user or system relying on NTLM authentication with gss-ntlmssp, an attacker could exploit this to cause memory exhaustion on your system during authentication attempts. This could slow down or crash your system, disrupting services that depend on NTLM authentication.

Useful 0 Not Useful 0

Mitigation Strategies

No direct mitigation is available. Since gss-ntlmssp was removed from RHEL 9+, upgrading to RHEL 9 or later mitigates this issue. For RHEL 8, avoid using NTLM authentication if possible or monitor for suspicious NTLM server behavior.

Useful 0 Not Useful 0