The vulnerability in MIT krb5's LDAP KDB plugin (berval2tl_data() function) performs an unsigned subtraction (bv_len - 2) without bounds checking. When bv_len is 0 or 1, the subtraction wraps to a large uint16_t value (65534 or 65535), causing malloc to allocate a large buffer and memcpy to read beyond the actual buffer size, resulting in a heap out-of-bounds read. This occurs when a malicious or compromised LDAP KDB backend returns a krbExtraData attribute with bv_len less than 2. The flaw affects Kerberos Key Distribution Center (KDC) and kadmind components that load principal data from LDAP backends. Exploitation requires LDAP backend compromise or write access. File-based KDB backends are unaffected. Red Hat classifies this as moderate impact with a CVSS 3.1 score of 5.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H). Ubuntu has issued security updates fixing this issue in krb5 packages for multiple LTS releases and other versions.

Successful exploitation can cause a denial of service via a heap out-of-bounds read leading to crashes or instability in Kerberos services (KDC or kadmind). Confidentiality impact is low, with no integrity impact reported. Exploitation requires high privileges (write access) to the LDAP backend used as the Kerberos database. File-based backends are not affected. There are no known exploits in the wild.

Red Hat states that no effective mitigation other than patching currently meets their criteria for ease of use and applicability. Ubuntu has released fixed krb5 package versions that address this vulnerability. Users should update to the fixed package versions as listed in the Ubuntu advisory and restart Kerberos services to apply the fix. Deployments using file-based KDB backends are not affected by this vulnerability. Monitor vendor advisories for updates. No additional mitigations are recommended by the vendor.