CVE-2024-37370

What it actually does

An attacker can alter the plaintext Extra Count field in a confidential GSS krb5 wrap token, causing the receiving application to treat the unwrapped token as truncated and potentially disclose additional plaintext data beyond intended boundaries.

Why it matters to the business

Organizations relying on Kerberos for authentication and secure messaging face risk of sensitive data exposure over the network, which may lead to credential theft, lateral movement, or compliance violations if unpatched versions remain in use.

How an attack unfolds

An attacker positioned on the network intercepts a GSS-API wrapped Kerberos token in transit, modifies the Extra Count field in the unauthenticated portion of the token, forwards the altered token to the target application, and observes the resulting truncated view that leaks additional confidential bytes.

How to fix it

Upgrade krb5 to the commit 8f56f544dd179056e9b8d02552e6c5e392eb2966 or later equivalent release that enforces integrity checks on the Extra Count field before unwrapping.

How to confirm the fix worked

Confirm the krb5 library version or commit hash matches or exceeds the fixed revision; perform regression tests that send modified wrap tokens and verify they are rejected rather than producing truncated output.

Typical attack path

1. Identify network traffic carrying confidential GSS krb5 wrap tokens
2. Capture a valid token and locate the Extra Count field
3. Increment or alter the Extra Count value to force truncation on unwrap
4. Replay or forward the modified token to the target service
5. Extract leaked plaintext from the application's truncated token processing

How to detect it

Inspect application and Kerberos library logs for anomalous token length mismatches or truncation warnings; correlate with network captures showing repeated wrap token replays from the same source.

What your security team should do

• Prioritize patching krb5 deployments that process GSS-API confidential tokens
• Review network segmentation and encryption requirements for Kerberos traffic
• Monitor for unexpected truncation or partial data handling in application logs
• Apply the fix in development, staging, and production environments within standard change windows given low EPSS