In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()<\/p>\n
ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC
\nlogin response with<\/p>\n
\tuser->passkey_sz = resp->hash_sz;
\n\tuser->passkey = kmalloc(resp->hash_sz, KSMBD_DEFAULT_GFP);
\n\tif (user->passkey)
\n\t\tmemcpy(user->passkey, resp->hash, resp->hash_sz);<\/p>\n
resp->hash_sz is a __u16 supplied by the response, but resp->hash[] is
\nonly KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login
\nresponse can set hash_sz well beyond that (up to 65535), so the memcpy()
\nreads past the end of the response object. ipc_validate_msg() does not
\nbound hash_sz, so reject any response whose hash_sz exceeds the on-stack
\nhash[] buffer before allocating and copying.<\/p>\n
[ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278\/0x680
\n[ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker\/4:1\/18611
\n[ 2030.242296]
\n[ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker\/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy)
\n[ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04\/01\/2014
\n[ 2030.242743] Workqueue: ksmbd-io handle_ksmbd_work
\n[ 2030.242763] Call Trace:
\n[ 2030.242769]
\n[ 2030.242776] dump_stack_lvl+0xa2\/0xd0
\n[ 2030.242794] print_address_description+0x77\/0x200
\n[ 2030.242815] ? ksmbd_alloc_user+0x278\/0x680
\n[ 2030.242831] print_report+0x58\/0x70
\n[ 2030.242848] kasan_report+0x117\/0x150
\n[ 2030.242869] ? ksmbd_alloc_user+0x278\/0x680
\n[ 2030.242888] kasan_check_range+0x3c7\/0x3f0
\n[ 2030.242908] ? ksmbd_alloc_user+0x278\/0x680
\n[ 2030.242925] __asan_memcpy+0x29\/0x70
\n[ 2030.242942] ksmbd_alloc_user+0x278\/0x680
\n[ 2030.242960] ksmbd_login_user+0xc3\/0x120
\n[ 2030.242978] ntlm_authenticate+0x5e6\/0x1b00
\n[ 2030.243017] ? __pfx_ntlm_authenticate+0x10\/0x10
\n[ 2030.243035] ? ksmbd_session_lookup+0x188\/0x1d0
\n[ 2030.243054] ? __pfx_ksmbd_session_lookup+0x10\/0x10
\n[ 2030.243090] ? __sanitizer_cov_trace_switch+0x7b\/0x140
\n[ 2030.243108] smb2_sess_setup+0x1e4a\/0x27b0
\n[ 2030.243126] ? copy_from_kernel_nofault+0x199\/0x300
\n[ 2030.243156] ? __pfx_smb2_sess_setup+0x10\/0x10
\n[ 2030.243173] ? get_smb2_cmd_val+0xe3\/0x1c0
\n[ 2030.243208] handle_ksmbd_work+0x954\/0x1280
\n[ 2030.243230] ? __pfx_handle_ksmbd_work+0x10\/0x10
\n[ 2030.243249] ? process_scheduled_works+0xa07\/0x1490
\n[ 2030.243270] ? process_scheduled_works+0xa07\/0x1490
\n[ 2030.243291] process_scheduled_works+0xa70\/0x1490
\n[ 2030.243320] ? __pfx_process_scheduled_works+0x10\/0x10
\n[ 2030.243340] ? do_raw_spin_lock+0x130\/0x300
\n[ 2030.243358] ? lock_is_held_type+0x7b\/0x110
\n[ 2030.243388] worker_thread+0x932\/0xe20
\n[ 2030.243415] kthread+0x38a\/0x470
\n[ 2030.243431] ? __pfx_worker_thread+0x10\/0x10
\n[ 2030.243451] ? __pfx_kthread+0x10\/0x10
\n[ 2030.243467] ret_from_fork+0x484\/0x910
\n[ 2030.243485] ? __pfx_ret_from_fork+0x10\/0x10
\n[ 2030.243501] ? __switch_to+0xc77\/0x12c0
\n[ 2030.243523] ? __pfx_kthread+0x10\/0x10
\n[ 2030.243540] ret_from_fork_asm+0x1a\/0x30
\n[ 2030.243564]
\n[ 2030.243570]
\n[ 2030.290164] Allocated by task 19279:
\n[ 2030.290911] kasan_save_track+0x3e\/0x80
\n[ 2030.292179] __kasan_kmalloc+0x72\/0x90
\n[ 2030.293217] __kvmalloc_node_noprof+0x3ff\/0x6b0
\n[ 2030.294467] handle_generic_event+0x59b\/0x750
\n[ 2030.295345] genl_family_rcv_msg_doit+0x238\/0x340
\n[ 2030.296553] genl_rcv_msg+0x606\/0x7b0
\n[ 2030.297129] netlink_rcv_skb+0x22b\/0x4a0
\n[ 2030.298500] genl_rcv+0x2d\/0x40
\n[ 2030.299273] netlink_unicast+0x7ba\/0x930
\n[ 2030.300019] netlink_sendmsg+0x8c3\/0xb00
\n[ 2030.301073] __sock_sendmsg+0xec\/0x140
\n[ 2030.301579] __sys_sendto+0x357\/0x470
\n[ 2030.302255] __x64_sys_sendto+0xe3\/0x100
\n[ 2030.303425] do_syscall_64+0x135\/0x460
\n[ 2030.304763] entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n[ 2030.305594]
\n[ 2030.305819] The buggy address belongs to the object at ffff888121bb6640
\n[ 2030.305819] which belongs to the cache kmalloc-192 of size 192
\n[ 2030.309595] The buggy address
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()<\/p>\n
ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC
\nlogin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25583","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}