In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()<\/p>\n
The permission-check ACE walk in smb_check_perm_dacl() validates the ACE
\nheader size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it
\nnever checks that ace->size is actually large enough to contain
\nnum_subauth sub-authorities before compare_sids() dereferences them.<\/p>\n
CIFS_SID_BASE_SIZE covers the SID header up to but excluding the
\nsub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,
\nso the existing guards only guarantee the 8-byte SID base, i.e. zero
\nsub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for
\ni num_subauth, ace->sid.num_subauth). The local
\ncomparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()
\nresult) always have at least one sub-authority, and an attacker controls
\nthe ACE revision and authority bytes (which lie within the in-bounds SID
\nbase), so they can match one of those SIDs and force the sub_auth read.<\/p>\n
A crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of
\nthe security descriptor therefore causes a heap out-of-bounds read of up
\nto SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd
\nallocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()
\ninto a buffer sized exactly to the on-disk data (kzalloc(sd_size) in
\nndr_decode_v4_ntacl()), so the read lands past the allocation. The
\nmalformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL
\nis not normalised before being written to the security.NTACL xattr) and
\nthe read fires on a subsequent SMB2_CREATE access check, making this
\nreachable by an authenticated client on a share that uses ACL xattrs.<\/p>\n
Add the missing num_subauth-versus-ace_size check, mirroring the
\nidentical guards already present in the sibling parsers parse_dacl() and
\nsmb_inherit_dacl().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()<\/p>\n
The permission-check ACE walk in smb_check_perm_dacl() validates the ACE
\nhe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14859","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}