[PATCH] ksmbd: fix channel_key buffer overflow in multichannel binding
Junye Ji via B4 Relay <[email protected]>
| Newsgroups | org.kernel.vger.linux-cifs,org.kernel.feeds.b4-sent,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Junye Ji <[email protected]> ksmbd_decode_ntlmssp_auth_blob() and ksmbd_krb5_authenticate() can write keys up to CIFS_KEY_SIZE. During SMB3 multichannel binding, their destination is the 16-byte channel_key stack buffer, so longer keys overwrite the stack. Size the temporary buffers for the accepted maximum. register_session_channel() still stores a 16-byte channel key. I reproduced the stack write with 17- and 40-byte NTLM keys and a 32-byte Kerberos subkey. On the fixed KASAN kernel, 16-, 17-, and 40-byte NTLM keys and 16- and 32-byte Kerberos subkeys completed 10 bindings each without a report. The existing length check still rejected a 41-byte NTLM key. Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") Assisted-by: Codex-Security:unspecified Signed-off-by: Junye Ji <[email protected]> --- I can send the reproducers and full KASAN logs privately if needed. --- fs/smb/server/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index b73167785e87..d8a7db655043 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -1689,7 +1689,7 @@ static int ntlm_authenticate(struct ksmbd_work *work, struct ksmbd_conn *conn = work->conn; struct ksmbd_session *sess = work->sess; struct ksmbd_user *user; - char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; + char channel_key[CIFS_KEY_SIZE] = {}; char *auth_key = conn->binding ? channel_key : sess->sess_key; u64 prev_id; bool binding = conn->binding; @@ -1826,7 +1826,7 @@ static int krb5_authenticate(struct ksmbd_work *work, struct ksmbd_conn *conn = work->conn; struct ksmbd_session *sess = work->sess; char *in_blob, *out_blob; - char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; + char channel_key[CIFS_KEY_SIZE] = {}; char *auth_key = conn->binding ? channel_key : sess->sess_key; u64 prev_sess_id; bool binding = conn->binding; --- base-commit: 44696aa3a489d2baf58efa61b37833f100072bee change-id: 20260712-ksmbd-channel-key-size-3aac1be670da Best regards, -- Junye Ji <[email protected]>