[PATCH] ksmbd: fix channel_key buffer overflow in multichannel binding

Junye Ji via B4 Relay <[email protected]>
Newsgroups org.kernel.vger.linux-cifs,org.kernel.feeds.b4-sent,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
From: Junye Ji <[email protected]>

ksmbd_decode_ntlmssp_auth_blob() and ksmbd_krb5_authenticate() can write
keys up to CIFS_KEY_SIZE. During SMB3 multichannel binding, their
destination is the 16-byte channel_key stack buffer, so longer keys
overwrite the stack.

Size the temporary buffers for the accepted maximum.
register_session_channel() still stores a 16-byte channel key.

I reproduced the stack write with 17- and 40-byte NTLM keys and a
32-byte Kerberos subkey. On the fixed KASAN kernel, 16-, 17-, and 40-byte
NTLM keys and 16- and 32-byte Kerberos subkeys completed 10 bindings each
without a report. The existing length check still rejected a 41-byte
NTLM key.

Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
Assisted-by: Codex-Security:unspecified
Signed-off-by: Junye Ji <[email protected]>
---
I can send the reproducers and full KASAN logs privately if needed.
---
 fs/smb/server/smb2pdu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index b73167785e87..d8a7db655043 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1689,7 +1689,7 @@ static int ntlm_authenticate(struct ksmbd_work *work,
 	struct ksmbd_conn *conn = work->conn;
 	struct ksmbd_session *sess = work->sess;
 	struct ksmbd_user *user;
-	char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};
+	char channel_key[CIFS_KEY_SIZE] = {};
 	char *auth_key = conn->binding ? channel_key : sess->sess_key;
 	u64 prev_id;
 	bool binding = conn->binding;
@@ -1826,7 +1826,7 @@ static int krb5_authenticate(struct ksmbd_work *work,
 	struct ksmbd_conn *conn = work->conn;
 	struct ksmbd_session *sess = work->sess;
 	char *in_blob, *out_blob;
-	char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};
+	char channel_key[CIFS_KEY_SIZE] = {};
 	char *auth_key = conn->binding ? channel_key : sess->sess_key;
 	u64 prev_sess_id;
 	bool binding = conn->binding;

---
base-commit: 44696aa3a489d2baf58efa61b37833f100072bee
change-id: 20260712-ksmbd-channel-key-size-3aac1be670da

Best regards,
-- 
Junye Ji <[email protected]>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.