Re: Fwd: ksmbd NTLM challenge blob heap buffer overflow (pre-auth)

Hi vova,

I am using the same `ksmbd.conf` as you, the length of the netbios name 
is 202.

After debugging, I found that the maximum value of 
`strlen(ksmbd_netbios_name())` is 15.

```
struct ksmbd_startup_request {
	__s8    netbios_name[16];
}
```

I also checked the ksmbd-tools source code (Link[1]), and it copies at 
most 15 characters:
```
// ksmbd-tools.git
// mountd/ipc.c
static int ipc_ksmbd_starting_up(void)
{
...
	if (global_conf.netbios_name) {
		strncpy(ev->netbios_name,
			global_conf.netbios_name,
			sizeof(ev->netbios_name) - 1);
	}
...
}

Link[1]: 
https://github.com/cifsd-team/ksmbd-tools/blob/c0ce0753144adab006552ed42e6862758ed6929d/mountd/ipc.c#L162

在 2026/8/8 1:32, vova tokarev 写道:
> The overflow is server-side, driven by the netbios name length. Your
> 290-byte response shows the server name is ~15 chars - too short for
> the overflow (needs >31 chars).
> 
> Please configure ksmbd with a long name before running the PoC:
> 
>    [global]
>        netbios name =
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>        server min protocol = SMB2
>        guest account = nobody
> 
>    [share]
>        path = /tmp/share
>        guest ok = yes
>        read only = yes
> 
> Then restart ksmbd.mountd and re-run the PoC. KASAN should fire.

-- 
ChenXiaoSong <[email protected]>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en