Dear Debian Heimdal maintainers,


I have observed a significant memory leak in Heimdal GSSAPI when used by slapd with SASL GSSAPI authentication.


The affected system is Debian Trixie with:


libgssapi3t64-heimdal:
7.8.git20221117.28daf24+dfsg-9+deb13u1


libheimntlm0t64-heimdal:
7.8.git20221117.28daf24+dfsg-9+deb13u1


The LDAP server is OpenLDAP slapd using Cyrus SASL GSSAPI.


Heaptrack shows that memory is continuously allocated from Heimdal NTLM GSS code during successful GSSAPI binds.


The largest allocation site is:


_gss_ntlm_allocate_ctx
at ntlm/accept_sec_context.c:52
in /lib/x86_64-linux-gnu/libgssapi.so.3


Heaptrack reports:

1.22G peak memory consumed over 555810 calls from:
_gss_ntlm_allocate_ctx


Another allocation path:


_gss_ntlm_acquire_cred
at ntlm/acquire_cred.c:60
in /lib/x86_64-linux-gnu/libgssapi.so.3


611.21M consumed over 277905 calls from:


_gss_ntlm_acquire_cred
gss_acquire_cred
_gss_spnego_acquire_cred
gssapi_server_mech_step::gssapi_server_mech_authneg
gssapi_server_mech_step
sasl_server_step
sasl_server_start
slap_sasl_bind
fe_op_bind
do_bind
connection_operation
connection_read_thread


The LDAP server receives many successful SASL GSSAPI binds overtime.

The memory usage grows over time as more GSSAPI binds are performed.

The allocation path indicates that SPNEGO credential handling initializes the Heimdal NTLM mechanism:

LDAP SASL GSSAPI bind
-> slapd
-> Cyrus SASL gssapi plugin
-> gssapi_server_mech_step
-> _gss_spnego_acquire_cred
-> _gss_ntlm_acquire_cred
-> _gss_ntlm_allocate_ctx


The authentication succeeds and appears to negotiate normal GSSAPI/Kerberos security (ssf=256), but NTLM contexts appear to be allocated and not released.


I believe this is a memory leak in Heimdal's GSS NTLM/SPNEGO implementation.


I provide the full heaptrack recording in this email. Just search for PEAK MEMORY CONSUMERS and it will show 1.22G of memory consumed. This is over an 18 hour period. After 2 or 3 weeks the memory grows to much and we have to restart slapd to release the memory.


Please let me know if additional debugging information is required.

Regards,
Tomas


IT-department

Stockholm University

106 91 Stockholm

www.su.se/it<http://www.su.se/it>

<http://www.su.se/it>

<https://www.su.se/om-webbplatsen-1.517562>

Tomas Björklund <tomas.bjorklund@su.se> writes:

Do you know if there is any upstream fix for this?

I don't know if there is any upstream fix for this.


//Tomas Björklund


IT-department

Stockholm University

106 91 Stockholm

www.su.se/it<http://www.su.se/it>

<http://www.su.se/it>

<https://www.su.se/om-webbplatsen-1.517562>


Do you know if there is any upstream fix for this?
--
Brian May @ Debian

I found that upstream has removed the ntlm code totally in this commit cbe156d9279effd6780fc36b620321e373217863


//Tomas Björklund


IT-department

Stockholm University

106 91 Stockholm

www.su.se/it<http://www.su.se/it>

<http://www.su.se/it>

<https://www.su.se/om-webbplatsen-1.517562>


Do you know if there is any upstream fix for this?
--
Brian May @ Debian

I have been using copilot to help me look into the heaptrack and also what can help with the leaks.
I attach a small patch that "he" says will fix the leaks. Please have a look at it if removing ntlm like upstream is not an option.


//Tomas Björklund


IT-department

Stockholm University

106 91 Stockholm

www.su.se/it<http://www.su.se/it>

<http://www.su.se/it>

<https://www.su.se/om-webbplatsen-1.517562>


Do you know if there is any upstream fix for this?
--
Brian May @ Debian

Tomas Björklund <tomas.bjorklund@su.se> writes:

As far as I can tell, neither patch reached the stable
branch. heimdal-7-8-branch

Will have a look at the patch you sent ASAP.

My computer is attempting to tell me that the patch as malformed:

git apply --check /tmp/0033-ntlm-fix-memory-leaks.patch
error: corrupt patch at /tmp/0033-ntlm-fix-memory-leaks.patch:73

i.e. was expecting 73 line patch, but 72 lines.

Please can you check?

Ah sorry for that. I made a new patch that should work.


//Tomas Björklund


IT-department

Stockholm University

106 91 Stockholm

www.su.se/it<http://www.su.se/it>

<http://www.su.se/it>

<https://www.su.se/om-webbplatsen-1.517562>

We believe that the bug you reported is fixed in the latest version of
heimdal, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142981@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Brian May <bam@debian.org> (supplier of updated heimdal package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 07 Aug 2026 07:52:40 +1000
Source: heimdal
Architecture: source
Version: 7.8.git20240113.1b4565a+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Brian May <bam@debian.org>
Changed-By: Brian May <bam@debian.org>
Closes: 1142981
Changes:
 heimdal (7.8.git20240113.1b4565a+dfsg-2) unstable; urgency=medium
 .
   * Add patch to fix memory leak in _gss_ntlm_allocate_ctx during
     SASL GSSAPI binds. Closes: #1142981.
Checksums-Sha1:
 3cca08dab66169de3c1a762826da8c850368fd2a 3804 heimdal_7.8.git20240113.1b4565a+dfsg-2.dsc
 73a1d5372e291764dca60564ba8d04627c882a9e 7769264 heimdal_7.8.git20240113.1b4565a+dfsg.orig.tar.xz
 a30133de1ebb4dd0b85ba06a7bcdf2341fc2ed59 139744 heimdal_7.8.git20240113.1b4565a+dfsg-2.debian.tar.xz
 ae0dfe5ab9f481349cd751922dd4f2adf41e7cab 6984 heimdal_7.8.git20240113.1b4565a+dfsg-2_source.buildinfo
Checksums-Sha256:
 bcbfdeca3e97fc3c12380095277164cca1c411b5ee5921fa99808f3426315e31 3804 heimdal_7.8.git20240113.1b4565a+dfsg-2.dsc
 c6be4df79cec5734bdc74432fd11dfb0639a4c4b795f01be968aab3c1d7fd488 7769264 heimdal_7.8.git20240113.1b4565a+dfsg.orig.tar.xz
 075e3c0b400bb97fa64f2a513847196ca57750e663f60fc8768e5c0c2591ecd6 139744 heimdal_7.8.git20240113.1b4565a+dfsg-2.debian.tar.xz
 c1afcaa0c912c98eb9afaf243a3b66b934590c4e9e8d48aff0b7ef958dbe09d3 6984 heimdal_7.8.git20240113.1b4565a+dfsg-2_source.buildinfo
Files:
 324620b7439ba3cd39c669d687370bb7 3804 net optional heimdal_7.8.git20240113.1b4565a+dfsg-2.dsc
 01116d29918f88aef14ad4b6101e0c9f 7769264 net optional heimdal_7.8.git20240113.1b4565a+dfsg.orig.tar.xz
 9ed5bf6d877fa7970f8c9f0252e718da 139744 net optional heimdal_7.8.git20240113.1b4565a+dfsg-2.debian.tar.xz
 3ce9ebd3d0d34b229b7c413082bb52ba 6984 net optional heimdal_7.8.git20240113.1b4565a+dfsg-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEKpwfR8DOwu5vyB4TKpJZkldkSvoFAmp1RngPHGJhbUBkZWJp
YW4ub3JnAAoJECqSWZJXZEr61FUP/19pxoXFgZGRf3BOp7abb/+DwR84peEGN5Uq
4x82bu4hkHr84/bjqkzJIuH496cenIgq9Sr4qYlYtaK5PzK5KRuS3JC0WiPf3i1q
tRrIPDkux+o3NVJoWEXZl+OnHFHDTLOIevzqzPcMK4XKbSr3tE8XhM35U0yN5snK
mzdtPzwFnqeozUBF0ERTH+SJI9tfEXZ+bHG333CIhXRKxvEtk3qKtaQlNLpnpJYc
R+3s3DUKfOfZP674yvDSuIzHf9yfLVya5E+TyVK1TnKFkAJW/e9YZQijGMvWY0iI
5WwljMHmj9JqeLxxeltoTlLWAD99yBJmmpjrM2gVPQvP9tPUfYgt51tNj+jDkBWo
cE9w7zH4Z+mhYmN1XxGD4GKcubzVPHYfZ0yhQF1hvWrNfAbSkO8RSSk5ZF04oS/X
E3eUSXksVwFl8cIVebd85riF9RP5OMU8lSshP4W9ka1tmc6edItMvb+XuV+P1VJs
a/Q7PxnXtHBSBpSRieUy/CugIcgqzW71jRZzga0Nu3XJ9RNwmNQhEbxR+GKva//x
QkT4VDPoYLPz5z4VUefWWfusqXskEPA7BfToXw05E2K/ks/0wB0publ0M4Rw2dys
INCgxmfNUgwdItc1gn4QjsIMU0jYz37/yCCxEX5/cLvw0Dw1/xrApjV8s2SxWIXM
Qimtu+ii
=pzZr
-----END PGP SIGNATURE-----