CVE-2020-28196

What it actually does

The flaw permits unbounded recursion in ASN.1 BER indefinite-length decoding within lib/krb5/asn.1/asn1_encode.c, exhausting stack space and crashing the Kerberos process on receipt of a crafted message.

Why it matters to the business

Successful exploitation halts Kerberos authentication services, blocking user logins, service tickets, and any dependent enterprise applications until the affected processes are restarted.

How an attack unfolds

An unauthenticated remote attacker sends a single specially constructed Kerberos protocol message containing deeply nested BER indefinite-length encodings; the decoder recurses without limit, triggering a stack overflow and immediate denial of service.

How to fix it

Upgrade krb5 to 1.17.2, 1.18.3 or newer; for Debian 9 apply package 1.7.9+dfsg-1+deb9u1; for GIT sources apply commit 4d6a54bca820327a339051853d0716f74985238c.

How to confirm the fix worked

Confirm the running krb5 library version matches or exceeds the listed fixed releases; optionally replay a benign test vector that previously triggered deep recursion and verify the process remains stable.

Typical attack path

1. Locate exposed Kerberos KDC or application services on the network
2. Generate a minimal ASN.1 BER message that uses indefinite-length encoding to arbitrary depth
3. Transmit the message to the target over UDP or TCP port 88
4. Observe process crash or excessive CPU/memory consumption confirming the recursion limit bypass

How to detect it

Review Kerberos daemon logs and system crash reports for abrupt terminations or stack-overflow signals immediately after receipt of a Kerberos request; inspect network captures for unusually large or malformed ASN.1 structures on port 88.

What your security team should do

• Apply the listed version upgrades on all Kerberos KDCs and client libraries within the next maintenance window
• Restrict inbound Kerberos traffic to trusted networks until patches are deployed
• Add version checks for krb5 to the vulnerability scanning policy