dotnet / dotnet/runtime

[Linux][Alpine 3.23] SIGSEGV in gss_init_sec_context during concurrent SQL Server SSPI authentication

Open
#123,782 11 comments 10 reactions 0 assignees View on GitHub
area-System.Net.Security os-linux tracking-external-issue
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

### Description

A segmentation fault occurs in the MIT Kerberos native libraries when multiple SQL Server connections concurrently perform SSPI authentication (Integrated Security) on Alpine Linux 3.23. The crash occurs during the P/Invoke call from NegotiateStreamPal.GssInitSecurityContext into gss_init_sec_context() in libgssapi_krb5.so.

This regression was introduced when Alpine updated their krb5 packages in version 3.23. The same workload runs without issue on Alpine 3.20, 3.21, and 3.22.

Our base image is mcr.microsoft.com/dotnet/aspnet:8.0-alpine, so a few weeks ago this change was pulled in via our CI automatically and caused issues under load.

### Reproduction Steps

1. Create a .NET 8 application that connects to SQL Server using Integrated Security
2. Deploy to a container based on mcr.microsoft.com/dotnet/aspnet:8.0-alpine (which pulls Alpine 3.23)
3. Apply concurrent load that causes connection pool expansion (4+ simultaneous new connections)
4. Application terminates with SIGSEGV

### Expected behavior

Concurrent SSPI authentication completes successfully, as it does on Alpine 3.22.

### Actual behavior

Process terminates with SIGSEGV (signal 11) during GSS-API security context initialization.

Exception Type: 0x20000000 (CLR signal-based exception)

### Regression?

Yes, in the previous release of mcr.microsoft.com/dotnet/aspnet:8.0-alpine which uses Alpine 3.22, there is no issue. We confirmed by only setting the base image to mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.22, which resolved the issue.

### Known Workarounds

Pinning to mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.22 to use Alpine 3.22.

### Configuration

| Component | Version |
|-----------|---------|
| .NET Runtime | 8.0.23 (8.0.2325.60607) |
| Microsoft.Data.SqlClient | 5.x (via EF Core) |
| OS | Alpine Linux 3.23 (x64) |
| C Library | musl libc (`ld-musl-x86_64.so.1`) |
| libkrb5.so | 3.3 |
| libgssapi_krb5.so | 2.2 |
| libkrb5support.so | 0.1 |
| Container Base | `mcr.microsoft.com/dotnet/aspnet:8.0-alpine` |

### Native Module Build IDs

From the crash dump:
```
/usr/lib/libkrb5.so.3.3 Build ID: 77009165be6662630a3749ba1e753130a5e2db4c
/usr/lib/libgssapi_krb5.so.2.2 Build ID: 3d4d5273b668d9a2b0eed2a57b4810429079d683
/usr/lib/libkrb5support.so.0.1 Build ID: e7c672f5159054fff41976fa2877d7d647dfb330
```

### Other information

### Crash Analysis

#### Call Stack (from core dump)

```
IL_STUB_PInvoke(Status ByRef, SafeGssCredHandle, SafeGssContextHandle ByRef, ...)
System.Net.Security.NegotiateStreamPal.GssInitSecurityContext(...)
System.Net.Security.NegotiateStreamPal.EstablishSecurityContext(...)
System.Net.Security.NegotiateStreamPal.InitializeSecurityContext(...)
Microsoft.Data.SqlClient.SNI.SNIProxy.GenSspiClientContext(...)
Microsoft.Data.SqlClient.TdsParser.SNISSPIData(...)
Microsoft.Data.SqlClient.TdsParser.ProcessSSPI(...)
Microsoft.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(...)
Microsoft.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(...)
Microsoft.Data.ProviderBase.DbConnectionPool.CreateObject(...)
Microsoft.Data.ProviderBase.DbConnectionPool.WaitForPendingOpen()
```

#### SafeHandle Corruption Evidence

Multiple `SafeGssContextHandle` objects show inconsistent state at crash time:
```
SafeGssContextHandle:
handle = 0x0000000000000000 (NULL - invalid)
_state = 4 (Closed/Disposed)
_fullyInitialized = true (Inconsistent with null handle)
```

This pattern indicates memory corruption or a race condition in the native GSS-API layer.

#### Parallel Stacks

Analysis of two independent crash dumps shows:
- **Dump 1:** 16 threads blocked in `GssInitSecurityContext`, 24 active SQL connections
- **Dump 2:** 4 threads blocked in `GssInitSecurityContext`, 5 active SQL connections

The crash occurs at both high and low concurrency levels.

### Root Cause Analysis

The issue appears to be a **thread-safety bug in the MIT Kerberos libraries** (`libkrb5`, `libgssapi_krb5`) shipped with Alpine 3.23. When multiple threads concurrently call `gss_init_sec_context()`:

1. The native credential cache or GSS context structures are accessed without proper synchronization
2. One thread corrupts or frees memory that another thread is actively using
3. This results in SIGSEGV when the corrupted pointer is dereferenced

The .NET `libSystem.Net.Security.Native.so` interop layer calls into these native libraries, and the crash occurs before control returns to managed code.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.