decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.
-
Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR):
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept'
-
Ensure unauthenticated or public access to port 88/tcp is removed:
firewall-cmd --permanent --remove-port=88/tcp
-
Apply the changes:
firewall-cmd --reload
Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.