CVE-2024-37370: MIT Kerberos 5 Information Disclosure Flaw

CVE-2024-37370 Overview

CVE-2024-37370 is a vulnerability in MIT Kerberos 5 (krb5) before version 1.21.3 that allows an attacker to modify the plaintext Extra Count field of a confidential GSS krb5 wrap token. When exploited, this causes the unwrapped token to appear truncated to the application, potentially leading to information disclosure or authentication bypass scenarios.

Critical Impact

Attackers can manipulate GSS-API wrap tokens to cause token truncation, potentially exposing sensitive authentication data or disrupting Kerberos-based authentication flows in enterprise environments.

Affected Products

• MIT Kerberos 5 (krb5) versions prior to 1.21.3
• Systems and applications utilizing GSS-API with MIT Kerberos for authentication
• Enterprise authentication infrastructure relying on krb5 wrap tokens

Discovery Timeline

• 2024-06-28 - CVE-2024-37370 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-37370

Vulnerability Analysis

This vulnerability exists in the GSS-API implementation within MIT Kerberos 5, specifically in how confidential wrap tokens are processed. The issue stems from insufficient verification of integrity (CWE-345) when handling the Extra Count field in GSS krb5 wrap tokens.

When a GSS wrap token is created with confidentiality protection, it includes an Extra Count field that is transmitted in plaintext alongside the encrypted payload. The vulnerability allows an attacker with network access to modify this plaintext field without detection. When the receiving application unwraps the token, it uses the manipulated Extra Count value, causing the resulting plaintext message to appear shorter than intended.

This truncation can have significant security implications depending on how the application processes the unwrapped data. Applications may interpret truncated messages incorrectly, potentially leading to information disclosure if partial data is processed or authentication state confusion.

Root Cause

The root cause is insufficient integrity verification of plaintext metadata fields within GSS krb5 wrap tokens. The Extra Count field, which indicates additional padding or data length information, is not adequately protected against modification by the cryptographic integrity mechanisms applied to the token. This allows an attacker to tamper with the field while the token traverses the network, without invalidating the token's authentication or encryption protections.

Attack Vector

The attack can be performed remotely by an attacker positioned on the network path between Kerberos clients and services. The attacker intercepts GSS krb5 wrap tokens in transit and modifies the plaintext Extra Count field. Since this field is not cryptographically bound to the protected portion of the token, the modification goes undetected. When the receiving party unwraps the token, the manipulated count value causes improper processing of the message boundaries.

The attack requires network-level access to intercept and modify Kerberos traffic, making it feasible in scenarios where an attacker has achieved a man-in-the-middle position or has compromised network infrastructure. No authentication or user interaction is required to execute this attack.

Detection Methods for CVE-2024-37370

Indicators of Compromise

• Unexpected truncation errors or parsing failures in applications using GSS-API authentication
• Anomalous Kerberos authentication failures that do not correlate with legitimate credential issues
• Network traffic showing modified GSS wrap tokens with inconsistent Extra Count values
• Application logs indicating message length mismatches during token unwrapping

Detection Strategies

• Monitor Kerberos authentication logs for unusual patterns of token validation failures
• Implement network intrusion detection rules to identify potential token manipulation attempts
• Deploy application-level logging to capture GSS-API unwrap operation anomalies
• Compare incoming token metadata against expected values for authenticated sessions

Monitoring Recommendations

• Enable verbose logging on Kerberos KDC and application servers during investigation periods
• Implement alerting for sudden increases in authentication failures across Kerberos-dependent services
• Monitor network traffic patterns for signs of man-in-the-middle positioning near Kerberos infrastructure
• Audit systems running vulnerable krb5 versions and prioritize monitoring on critical authentication pathways

How to Mitigate CVE-2024-37370

Immediate Actions Required

• Upgrade MIT Kerberos 5 to version 1.21.3 or later immediately
• Review network segmentation to limit exposure of Kerberos traffic to potential interception
• Implement additional network-level encryption (IPsec, TLS) for sensitive authentication traffic
• Audit applications dependent on GSS-API for custom token handling that may amplify the vulnerability impact

Patch Information

MIT has released a security patch addressing this vulnerability. The fix is available in MIT Kerberos 5 version 1.21.3 and later. The specific commit addressing this issue can be found at the GitHub krb5 repository commit 55fbf435edbe2e92dd8101669b1ce7144bc96fef. Additional security advisories and guidance are available from the MIT Kerberos Security Advisories page.

Organizations using affected NetApp products should also consult the NetApp Security Advisory NTAP-20241108-0007 for vendor-specific guidance.

Workarounds

• Implement network segmentation to isolate Kerberos traffic from untrusted network segments
• Deploy additional transport-layer encryption to protect Kerberos traffic against interception
• Monitor and validate GSS-API token processing at the application level where feasible
• Consider implementing application-layer message length validation as a defense-in-depth measure

# Verify installed krb5 version on Linux systems
krb5-config --version

# Check for vulnerable packages on RHEL/CentOS
rpm -qa | grep krb5

# Check for vulnerable packages on Debian/Ubuntu
dpkg -l | grep krb5

# Update krb5 packages (example for RHEL/CentOS)
yum update krb5-libs krb5-workstation

# Update krb5 packages (example for Debian/Ubuntu)
apt-get update && apt-get upgrade libkrb5-3