Re: Fwd: ksmbd NTLM challenge blob heap buffer overflow (pre-auth)

Hi vova,

I could not reproduce the issue using your poc. I am not sure if I 
missed any steps.

Below is the information about my test environment:

- kernel: v7.1, CONFIG_KASAN=y
- Architecture: aarch64
- Linux distribution version: Fedora release 40 (Forty)

Below is the log after running the poc (indicating the poc ran 
successfully), but there are no error messages in the ksmbd dmesg output:

```
./poc_ksmbd_ntlm_oob 192.168.53.211 445
=====================================================
   ksmbd NTLM Challenge Blob Heap Overflow (RV-W1-001)
   Pre-auth remote: SMB2 SESSION_SETUP, no credentials
   Overflow: ~1620 bytes past kmalloc-512 boundary
=====================================================

[+] Connected to 192.168.53.211:445
[+] NEGOTIATE: status=0x00000000
[>] Sending SESSION_SETUP with NTLMSSP_NEGOTIATE
[>] Server will build challenge blob with its long netbios name
[>] If name > ~47 chars: blob > 448 bytes = heap overflow
[+] Response: 290 bytes, status=0xc0000016
[+] STATUS_MORE_PROCESSING_REQUIRED -- server survived

[*] Check dmesg for:
     BUG: KASAN: slab-out-of-bounds in ksmbd_build_ntlmssp_challenge_blob
     or: Unable to handle kernel paging request at <name-derived address>
```

On 8/7/26 18:34, vova tokarev wrote:
> Hi,
> 
> It's been almost two months since I reported this, and I haven't heard
> back. Reaching out to you directly as the ksmbd maintainers.
> 
> The bug: ksmbd_build_ntlmssp_challenge_blob() in fs/smb/server/auth.c
> copies the netbios name (UTF-16LE) into TargetName + 4 AV_PAIR entries
> with no check against the 448-byte MAX_CIFS_SMALL_BUFFER_SIZE response
> buffer. A netbios name > ~47 chars overflows into adjacent kmalloc-512
> objects (up to ~1620 bytes). Triggered pre-auth by any SMB2 client
> sending raw NTLMSSP_NEGOTIATE (no SPNEGO).
> 
> ksmbd accepts names up to 255 bytes via netlink with no enforcement of
> the 15-char NetBIOS limit.
> 
> Confirmed with KASAN: slab-out-of-bounds in
> ksmbd_build_ntlmssp_challenge_blob. Full PoC and KASAN output in my
> original report.
> 
> Thanks,
> Vladimir
> 
> ---------- Forwarded message ---------
> From: *vova tokarev* <[email protected] 
> <mailto:[email protected]>>
> Date: Fri, Jul 3, 2026 at 6:01 PM
> Subject: ksmbd NTLM challenge blob heap buffer overflow (pre-auth)
> To: <[email protected] <mailto:[email protected]>>
> 
> 
>   Hi,
> 
> ksmbd_build_ntlmssp_challenge_blob() in fs/smb/server/auth.c writes the
> NTLM challenge blob into a 448-byte SESSION_SETUP response buffer without
> checking the size. With a netbios name longer than ~47 characters, the blob
> overflows up to ~1620 bytes into adjacent kmalloc-512 objects.
> 
> The trigger is a pre-auth SMB2 SESSION_SETUP with NTLM Negotiate. (this 
> works with No credentials) KASAN confirms slab-out-of-bounds writes; 
> corrupted adjacent data
> causes kernel crashes at netbios-name-derived addresses.
> 
> Affected: Linux 5.15+. Confirmed on 7.1.0 (aarch64) with KASAN.
> 
> Attached ZIP: report, userspace PoC (poc_ksmbd_ntlm_oob.c), KASAN output.
> 
> Suggested fix: reject blob_len that exceeds available response buffer space.
> 
> Thank you,
> Vladimir Tokarev

-- 
ChenXiaoSong <[email protected]>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en