CVE-2024-26458

A memory leak flaw was found in krb5 in /krb5/src/lib/rpc/pmap_rmt.c. This issue can lead to a denial of service through memory exhaustion.

In pmap_rmt.c, a variable named port_ptr is defined and its address is passed to gssrpc_xdr_reference, where it is called pp. The program uses the macro mem_alloc (which refers to malloc) to allocate dynamic memory for pp. After allocation, if the xdr_u_int32(xdrs, &crp->resultslen) call within the if condition returns false, the overall if statement evaluates to false. The program then returns without using or freeing the memory allocated to port_ptr, resulting in a memory leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.