When a kerberos 5 ticket is being decoded so that it can be loaded into an rxrpc-type key, the length of a variable-length field is checked to make sure that it's not going to overrun the allocated buffer space. The data is padded to the nearest four-byte boundary and the code doesn't check for this extra four-byte aligned padding. This can lead to the size-remaining variable wrapping and the data pointer accessing or reading past the end of the buffer. The read functionality could allow for a 3 byte infoleak and the write flaw could allow for an uncontrolled 3 byte write to kernels slab memory. This could lead to memory corruption and possible privilege escalation although no known exploit exists at the time of writing. https://nvd.nist.gov/vuln/detail/CVE-2017-7482
