Description

CVE-2024-26458 affects Kerberos 5 (krb5) version 1.21.2, specifically within the /krb5/src/lib/rpc/pmap_rmt.c component. The vulnerability manifests as a memory leak, potentially leading to resource depletion and system instability. While the CVSS score is 0, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a moderate risk level.

Key Insights

• Memory Leak: The vulnerability causes a memory leak, which can lead to resource depletion and system instability. This can potentially disrupt critical services relying on Kerberos for authentication.
• Impact on Kerberos: The memory leak is located in the Kerberos 5 authentication system, impacting its functionality and security.
• Active Exploitation: The CVE is tagged "In The Wild," indicating that attackers are actively exploiting this vulnerability.
• No Public Exploits: Despite active exploitation, no publicly available exploits have been identified. This means attackers are likely using custom-developed tools to exploit this vulnerability.

Mitigation Strategies

1. Update Kerberos: Patching the affected version of Kerberos to 1.21.3 or later is the most effective way to mitigate this vulnerability.
2. Implement Access Controls: Limit access to the vulnerable Kerberos component to only authorized users and applications.
3. Monitor System Resources: Closely monitor system resources, particularly memory usage, for signs of resource depletion. This can help identify potential exploitation attempts.
4. Security Awareness: Raise awareness among system administrators and users about the vulnerability and the potential risks involved.

Additional Information: If you have further questions regarding this incident, you can utilize the "Ask to Analyst" feature, contact SOCRadar directly, or open a support ticket for additional information.