CVE-2024-26461

What it actually does

Memory leak in the GSSAPI krb5 sealing routine (k5sealv3.c) causes repeated allocation of memory that is never freed when processing certain Kerberos messages, leading to gradual resource exhaustion.

Why it matters to the business

Affected systems may experience denial-of-service conditions from memory exhaustion during normal network authentication traffic, increasing operational overhead on older Ubuntu deployments of Wireshark that embed the vulnerable Kerberos library.

How an attack unfolds

An attacker sends a crafted sequence of Kerberos GSSAPI messages over the network that trigger the leak path in k5sealv3.c; each message consumes additional memory that is never released, eventually causing the process to exhaust available RAM and become unresponsive.

How to fix it

Upgrade Wireshark on Ubuntu 14.04 LTS to version 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 or later and on Ubuntu 16.04 LTS to version 2.0.2+ga16e22e-1 or later; rebuild any dependent packages that statically link the vulnerable krb5 library.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases; run memory-leak detection tools against the gssapi/krb5 code paths with crafted test vectors; confirm absence of the vulnerable k5sealv3.c logic in the running binary.

Typical attack path

1. Identify network-accessible services using the vulnerable krb5 GSSAPI implementation
2. Craft and transmit repeated Kerberos authentication or ticket messages that exercise the sealing code path
3. Monitor target memory consumption until the process crashes or becomes unresponsive
4. Repeat or sustain traffic to maintain the denial-of-service condition

How to detect it

Review system and application logs for repeated Kerberos GSSAPI errors or authentication failures coinciding with unexplained memory growth; inspect process memory dumps for accumulation of unreleased buffers originating from the sealing routine.

What your security team should do

• Prioritize patching Ubuntu 14.04 and 16.04 systems running Wireshark within the next maintenance window
• Inventory all systems that embed or depend on krb5 1.21.2 or earlier
• Implement network segmentation or rate limiting for Kerberos traffic to reduce exposure until patches are applied
• Monitor memory usage of authentication processes for sudden growth patterns