Fwd: ksmbd NTLM challenge blob heap buffer overflow (pre-auth)

Hi,

It's been almost two months since I reported this, and I haven't heard
back. Reaching out to you directly as the ksmbd maintainers.

The bug: ksmbd_build_ntlmssp_challenge_blob() in fs/smb/server/auth.c
copies the netbios name (UTF-16LE) into TargetName + 4 AV_PAIR entries
with no check against the 448-byte MAX_CIFS_SMALL_BUFFER_SIZE response
buffer. A netbios name > ~47 chars overflows into adjacent kmalloc-512
objects (up to ~1620 bytes). Triggered pre-auth by any SMB2 client
sending raw NTLMSSP_NEGOTIATE (no SPNEGO).

ksmbd accepts names up to 255 bytes via netlink with no enforcement of
the 15-char NetBIOS limit.

Confirmed with KASAN: slab-out-of-bounds in
ksmbd_build_ntlmssp_challenge_blob. Full PoC and KASAN output in my
original report.

Thanks,
Vladimir

---------- Forwarded message ---------
From: vova tokarev <[email protected]>
Date: Fri, Jul 3, 2026 at 6:01 PM
Subject: ksmbd NTLM challenge blob heap buffer overflow (pre-auth)
To: <[email protected]>


 Hi,

ksmbd_build_ntlmssp_challenge_blob() in fs/smb/server/auth.c writes the
NTLM challenge blob into a 448-byte SESSION_SETUP response buffer without
checking the size. With a netbios name longer than ~47 characters, the blob
overflows up to ~1620 bytes into adjacent kmalloc-512 objects.

The trigger is a pre-auth SMB2 SESSION_SETUP with NTLM Negotiate. (this
works with No credentials) KASAN confirms slab-out-of-bounds writes;
corrupted adjacent data
causes kernel crashes at netbios-name-derived addresses.

Affected: Linux 5.15+. Confirmed on 7.1.0 (aarch64) with KASAN.

Attached ZIP: report, userspace PoC (poc_ksmbd_ntlm_oob.c), KASAN output.

Suggested fix: reject blob_len that exceeds available response buffer space.

Thank you,
Vladimir Tokarev