In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl<\/p>\n
set_ntacl_dacl() copies each ACE from the attacker-controlled stored
\nsecurity descriptor verbatim into the response DACL without checking
\nsid.num_subauth. The ACE bytes (including an unchecked num_subauth)
\noriginate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is
\nstored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE
\nwith `break` rather than an error, so parse_sec_desc() still returns
\nsuccess and the malformed SD reaches the xattr intact.<\/p>\n
On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a
\nPOSIX access ACL, build_sec_desc() -> set_ntacl_dacl() ->
\nset_posix_acl_entries_dacl() walks the copied ACEs and reads<\/p>\n
ntace->sid.sub_auth[ntace->sid.num_subauth – 1]<\/p>\n
with num_subauth taken straight from the stored SD. Since sub_auth[]
\nis fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.
\n255) drives an out-of-bounds heap read of ~1 KB with an offset fully
\ncontrolled by an authenticated client.<\/p>\n
The sibling functions already gate this field:
\n parse_dacl() — num_subauth == 0 || > SID_MAX_SUB_AUTHORITIES
\n parse_sid() — num_subauth > SID_MAX_SUB_AUTHORITIES
\n smb_copy_sid() — min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES)
\nset_ntacl_dacl() is the lone inconsistent path that omits the check.<\/p>\n
Add the same num_subauth validation in set_ntacl_dacl() before copying
\nthe ACE, matching the gate already enforced by parse_dacl().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl<\/p>\n
set_ntacl_dacl() copies each ACE from the attacker-controlled store<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5324","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}