github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CVE-2026-42218: Ensure auth fails take a fixed time

Browse Source 
Implement a constant time for password-based authentication failure.
This commit is contained in:
matt335672
2026-04-27 10:19:57 +01:00
parent 102da4f42b
commit 07479384a6
1 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sesman/sesexec/login_info.c
+27 -1
View File
@@ -41,6 +41,17 @@
#include "sesexec.h"
#include "string_calls.h"
// Sys login fails all take a fixed time before returning. This
// prevents an attacker using timing differences to determine
// information about the users on the system (CVE-2026-42218)
//
// Note that some systems may provide an upper time bound for
// a login failure that is higher than this. For example, the Linux
// PAM stack default sys login fail time is around 2000 milli-seconds.
// Consequently, it is important the auth stack is always called, even
// if it has been determined that this is unnecessary.
#define FAILED_LOGIN_CONSTANT_TIME 600 // milli-seconds
/******************************************************************************/
/**
* Logs an authentication failure message
@@ -72,7 +83,6 @@ log_authfail_message(const char *username, const char *ip_addr)
* @return Status for the operation
*
* @post If E_SCP_LOGIN_OK is returned, g_login_info is filled in
*
*/
static enum scp_login_status
authenticate_and_authorize_connection(const char *supplied_username,
@@ -84,6 +94,7 @@ authenticate_and_authorize_connection(const char *supplied_username,
char *username; // From reverse-looking up the UID
enum scp_login_status status;
struct auth_info *auth_info;
unsigned int start_time = g_get_elapsed_ms();
if (g_getuser_info_by_name(supplied_username,
&uid, NULL, NULL, NULL, NULL) != 0)
@@ -93,6 +104,11 @@ authenticate_and_authorize_connection(const char *supplied_username,
supplied_username);
log_authfail_message(supplied_username, ip_addr);
status = E_SCP_LOGIN_NOT_AUTHENTICATED;
/* Call the auth stack anyway. On some systems (e.g. linux-pam),
* a fixed delay is built in to the stack for an unsuccessful
* login, and this delay may exceed FAILED_LOGIN_CONSTANT_TIME */
auth_end(auth_userpass(username, password, ip_addr, NULL));
}
else if (g_getuser_info_by_uid(uid,
&username,
@@ -100,6 +116,7 @@ authenticate_and_authorize_connection(const char *supplied_username,
{
LOG(LOG_LEVEL_ERROR, "Can't reverse lookup UID %d", uid);
status = E_SCP_LOGIN_NOT_AUTHENTICATED;
auth_end(auth_userpass(username, password, ip_addr, NULL));
}
else
{
@@ -179,6 +196,15 @@ authenticate_and_authorize_connection(const char *supplied_username,
g_free(username);
}
if (status != E_SCP_LOGIN_OK)
{
unsigned int elapsed_ms = g_get_elapsed_ms() - start_time;
if (elapsed_ms < FAILED_LOGIN_CONSTANT_TIME)
{
g_sleep(FAILED_LOGIN_CONSTANT_TIME - elapsed_ms);
}
}
return status;
}