A vulnerability in the MIT Kerberos implementation

MIT Kerberos (krb5) uses the RC4-HMAC-MD5 encryption type as a legacy option for interoperability with older Windows/AD deployments. CVE-2025-3576 is a CWE-328 (weak hash) issue: because the GSSAPI per-message integrity checksum inside the RC4-HMAC codepath relies on MD5 — a hash with practical chosen-prefix collisions since 2007 — an on-path attacker who can observe and modify GSSAPI-protected traffic can craft a colliding message that verifies as authentic. Affected: all krb5 prior to the April 2025 fix, including distro packages krb5 < 1.21.3-x where x is the vendor backport (RHEL 8/9 via RHSA-2025:8411 and follow-ups, SUSE, Ubuntu, Amazon Linux, Rocky).

The vendor MEDIUM (5.9) rating is *fair*. The bug is real cryptography rot, but the CVSS vector (AV:N/AC:H/PR:N/UI:N/C:N/I:H/A:N) already prices in the two big constraints: attack complexity is High (you need MITM and a workable MD5 collision inside the message envelope) and only Integrity is impacted — no confidentiality break, no availability, no direct credential theft. This is not Zerologon and it is not a Kerberos auth bypass in the marketing sense; it is a cryptographic downgrade window that closes the moment your realm stops offering RC4.

Why this verdict

• Friction 1 — MITM prerequisite: attacker must already be on-path between client and service. This implies post-initial-access positioning; unauthenticated internet exploitation is not a realistic scenario.
• Friction 2 — RC4 must be negotiated: modern AD (Windows Server 2022+/2025) and RHEL 9 defaults disable RC4-HMAC. Enterprises that followed Microsoft's November 2022 hardening have already closed the door.
• Friction 3 — no weaponization: MD5 collision against a keyed HMAC-style GSSAPI checksum is a research-grade operation, not an off-the-shelf impacket module. EPSS 0.276% reflects this.
• Role multiplier — Kerberos KDC / krb5 library: Kerberos is canonically identity-plane. However, the impact is Integrity-only inside an existing GSSAPI session — no ticket forgery, no TGT theft, no credential compromise. The chain does NOT end in domain takeover, so the identity-role floor does not lift this above MEDIUM. Contrast with Zerologon, where the chain ended in DC secret disclosure.
• Role multiplier — application servers (NFS, LDAP, SMB, HTTP-SPNEGO): in the worst case, a forged GSSAPI message could tamper with one RPC call in a live session. Blast radius = one session, one operation. Does not clear the HIGH floor.
• Detection asymmetry: you cannot see the forgery, but you *can* see RC4 in your 4769 events. Killing RC4 kills the vuln, which makes this a hygiene problem, not a fire drill.

Why not higher?

No credential theft, no lateral movement primitive, no TGT/service-ticket forgery, no availability impact. The integrity break lives inside a session the attacker already has to be on-path for. HIGH would require either public weaponization or a chain ending in identity compromise — neither exists.

Why not lower?

It is a real cryptographic weakness in a security-critical library on identity-plane infrastructure. Environments running legacy trusts with RC4 enabled — still common in banking, healthcare, and manufacturing — face genuine (if narrow) integrity risk. LOW would understate that.

1. Disable RC4-HMAC etype fleet-wide — Set msDS-SupportedEncryptionTypes on user, computer, and service accounts to 0x18 (AES128 + AES256 only). On MIT KDCs, remove arcfour-hmac from permitted_enctypes, default_tkt_enctypes, and default_tgs_enctypes in krb5.conf. No noisgate mitigation SLA for MEDIUM — but do this inside the 365-day remediation window and ideally in the next scheduled AD hardening sprint.
2. Hunt RC4 tickets in auth logs — Query Event ID 4769 for Ticket Encryption Type = 0x17 (RC4-HMAC) across the last 90 days. Every account that still requests RC4 is a migration ticket. Target: zero RC4 4769s before you flip the default.
3. Patch krb5 packages on the normal cadence — Roll krb5-libs from RHSA-2025:8411 (and successors) through your standard monthly patch train. No emergency window required — noisgate remediation SLA is 365 days for MEDIUM.
4. Enforce LDAP signing and SMB signing — These add a second, non-MD5 integrity layer on top of Kerberos GSSAPI. A forged MIC still gets caught by SMB3 AES-CMAC signing. Free defense-in-depth that also mitigates NTLM-relay class attacks.
5. Segment legacy RC4-required systems — If a NAS, mainframe gateway, or SAP appliance genuinely requires RC4, isolate it on a VLAN with IPsec transport policy so on-path MITM becomes physically implausible.

Run on any Linux host that has krb5-libs / krb5-user installed. Invoke as bash check-cve-2025-3576.sh. No root required for the package version check; add sudo only if you also want the config sanity pass. Emits VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check-cve-2025-3576.sh — MIT Kerberos RC4-HMAC-MD5 GSSAPI forgery check
# Usage: bash check-cve-2025-3576.sh
set -u

FIXED_UPSTREAM="1.21.3"
STATUS="UNKNOWN"
REASON=""

ver_ge() { # $1 >= $2 ?
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -1)" = "$2" ]
}

get_ver() {
  if command -v rpm >/dev/null 2>&1; then
    rpm -q --qf '%{VERSION}-%{RELEASE}\n' krb5-libs 2>/dev/null | head -1
  elif command -v dpkg-query >/dev/null 2>&1; then
    dpkg-query -W -f='${Version}\n' libkrb5-3 2>/dev/null | head -1
  else
    echo ""
  fi
}

VER="$(get_ver)"
if [ -z "$VER" ]; then
  echo "UNKNOWN: krb5 not installed or package manager not detected"
  exit 2
fi

# Distro backport check (RHEL RHSA-2025:8411+ ships fix in older upstream versions)
if command -v rpm >/dev/null 2>&1; then
  if rpm -q --changelog krb5-libs 2>/dev/null | grep -qiE 'CVE-2025-3576|3576'; then
    STATUS="PATCHED"
    REASON="changelog references CVE-2025-3576"
  fi
fi

# Upstream version check as fallback
UPSTREAM_VER="$(echo "$VER" | awk -F- '{print $1}')"
if [ "$STATUS" != "PATCHED" ]; then
  if ver_ge "$UPSTREAM_VER" "$FIXED_UPSTREAM"; then
    STATUS="PATCHED"
    REASON="krb5 $UPSTREAM_VER >= $FIXED_UPSTREAM"
  else
    STATUS="VULNERABLE"
    REASON="krb5 $UPSTREAM_VER < $FIXED_UPSTREAM and no backport marker"
  fi
fi

# Exposure amplifier: RC4 still permitted?
RC4_ENABLED="unknown"
if [ -r /etc/krb5.conf ]; then
  if grep -Eiq 'arcfour-hmac|rc4-hmac' /etc/krb5.conf; then
    RC4_ENABLED="yes"
  else
    RC4_ENABLED="no (or default)"
  fi
fi

echo "krb5 version:        $VER"
echo "RC4-HMAC in krb5.conf: $RC4_ENABLED"
echo "Status:              $STATUS ($REASON)"

case "$STATUS" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. NVD — CVE-2025-3576
2. Red Hat Security — CVE-2025-3576
3. SUSE Security — CVE-2025-3576
4. SentinelOne Vulnerability DB
5. Wiz Vulnerability DB — CVE-2025-3576
6. Rapid7 — Rocky Linux krb5 advisory
7. Amazon Linux Security — CVE-2025-3576
8. CVE Details — CVE-2025-3576