CVE-2024-37370: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count...

The analysis is based on the provided commit 55fbf435edbe2e92dd8101669b1ce7144bc96fef, which explicitly aims to fix CVE-2024-37370 and CVE-2024-37371. The commit message details the flaws: missing Extra Count verification (CVE-2024-37370) and insufficient length checks leading to memory safety issues (CVE-2024-37371). The modified C functions (gss_krb5int_unseal_token_v3, gss_krb5int_unseal_v3_iov, and kg_unseal_iov_token) are directly involved in processing GSS wrap tokens.

1. gss_krb5int_unseal_token_v3 had missing checks for both plaintext length (potentially leading to reads before buffer start) and Extra Count field consistency.
2. gss_krb5int_unseal_v3_iov had a missing check for Extra Count field consistency.
3. kg_unseal_iov_token had improper handling of ASN.1 wrapper lengths relative to the header buffer size, potentially leading to reads beyond the buffer. The patches add these missing checks and refine parsing logic, confirming these functions were the sites of the vulnerabilities.