CVE-2024-26462

What it actually does

Memory leak in the KDC NDR parsing code path allows repeated allocation without corresponding free, exhausting heap memory under sustained local trigger conditions and resulting in denial of service.

Why it matters to the business

Kerberos authentication services on affected Ubuntu systems can become unavailable, disrupting user logins, service tickets, and dependent enterprise applications until the process is restarted or the host is rebooted.

How an attack unfolds

An attacker with local access supplies crafted input that exercises the vulnerable NDR code path in the KDC, causing incremental memory allocations that are never released; repeated invocation leads to resource exhaustion and service failure.

How to fix it

Upgrade the linux, linux-aws, or linux-azure packages on Ubuntu 24.04 LTS to the versions containing the fix (linux: 6.8.0-50.51, linux-aws: 6.8.0-1020.22, linux-azure: 6.8.0-1020.23) and restart affected services or hosts.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases, confirm the krb5 KDC process no longer exhibits unbounded memory growth under load, and review changelog entries for the ndr.c memory-leak correction.

Typical attack path

1. Obtain local shell or process execution context on an affected Ubuntu system
2. Trigger the KDC NDR code path with repeated crafted requests or inputs
3. Monitor system memory until the KDC process or host experiences resource exhaustion
4. Observe authentication failures for users and services relying on Kerberos

How to detect it

Review system and application logs for repeated KDC crashes or restarts accompanied by memory-pressure warnings; correlate with authentication failure spikes; examine process memory growth of krb5kdc over time.

What your security team should do

• Apply the kernel package updates to all Ubuntu 24.04 LTS systems running Kerberos KDC within the next maintenance window
• Prioritize systems that host production KDC instances or have high authentication volume
• Monitor memory usage of krb5kdc processes after patching to confirm stability
• Review local access controls to reduce the number of principals that can reach the KDC