In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: reject non-VALID session in compound request branch<\/p>\n
smb2_check_user_session() takes a shortcut for any operation that is not
\nthe first in a COMPOUND request: it reuses work->sess (the session bound by
\nthe first operation) and validates only the SessionId, then returns
\n“valid”. It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
\nSessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
\nvalue) skips even the id comparison. The standalone path
\n(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
\nenforce the VALID state; the compound branch bypasses all of it.<\/p>\n
A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
\na fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
\n(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
\na COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
\n\\hostIPC$), the tree-connect then runs on that IN_PROGRESS session and
\nreaches ksmbd_ipc_tree_connect_request(), which dereferences
\nuser_name(sess->user) with sess->user == NULL (transport_ipc.c:687\/701\/704)
\n-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
\nworker for all clients.<\/p>\n
Reject any non-first compound operation that lands on a session which is
\nnot SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
\nenforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
\nbut it is never carried as a non-first compound operation, so multi-leg
\nauthentication is unaffected by this check.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: reject non-VALID session in compound request branch<\/p>\n
smb2_check_user_session() takes a shortcut for any operation that is no<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14853","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}