In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: fix heap overflow in DACL owner\/group rewrite<\/p>\n
When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a
\nbuffer sized according to the on-disk DACL length reported by
\ndacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each
\nACE with a new owner\/group SID obtained from the cifs.idmap upcall.
\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,
\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).<\/p>\n
If the original DACL contains short SIDs (e.g., 1 sub-authority) while
\nthe replacement SIDs are long, the rewritten ACEs overflow the
\nallocation.<\/p>\n
Fix this by always budgeting for worst-case SID expansion: allocate
\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which
\ncovers the smb_acl header and room for every ACE at maximum SID size.
\nThis replaces the previous split logic that used dacl_ptr->size for
\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid
\nmounts: both paths can trigger the same rewrite and need the same
\nheadroom.<\/p>\n
KASAN reports this as:
\n BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a\/0x2680 [cifs]
\n Write of size 4 at addr ffff8881a5e25374 by task chown\/5298
\n …
\n The buggy address is located 0 bytes to the right of
\n allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: fix heap overflow in DACL owner\/group rewrite<\/p>\n
When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a
\nbuff<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28987","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}