Re: [PATCH] ksmbd: fix channel_key buffer overflow in multichannel binding
Namjae Jeon <[email protected]>
| Newsgroups | org.kernel.vger.linux-cifs,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <CAKYAXd-br3fg=9_E3bWqHv_yiR2w81F-vUP_8EzGz5Ajs1owow@mail.gmail.com> |
On Mon, Jul 13, 2026 at 5:21 AM Junye Ji via B4 Relay <[email protected]> wrote: > > From: Junye Ji <[email protected]> > > ksmbd_decode_ntlmssp_auth_blob() and ksmbd_krb5_authenticate() can write > keys up to CIFS_KEY_SIZE. During SMB3 multichannel binding, their > destination is the 16-byte channel_key stack buffer, so longer keys > overwrite the stack. > > Size the temporary buffers for the accepted maximum. > register_session_channel() still stores a 16-byte channel key. > > I reproduced the stack write with 17- and 40-byte NTLM keys and a > 32-byte Kerberos subkey. On the fixed KASAN kernel, 16-, 17-, and 40-byte > NTLM keys and 16- and 32-byte Kerberos subkeys completed 10 bindings each > without a report. The existing length check still rejected a 41-byte > NTLM key. > > Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") > Assisted-by: Codex-Security:unspecified > Signed-off-by: Junye Ji <[email protected]> I have already applied the same patch that arrived before you. https://github.com/smfrench/smb3-kernel/commit/578dc53f371ed19a8a9dc357af376a515f4c8ddb Thanks.