Re: Fwd: ksmbd NTLM challenge blob heap buffer overflow (pre-auth)

Hi Namjae,

We have confirmed that this issue does not exist.

On 8/8/26 17:34, vova tokarev wrote:
> Hi ChenXiaoSong,
> 
> You are right. I missed that ksmbd_startup_request.netbios_name is
> char[16], and ksmbd-tools strncpy's to 15 chars max. The kernel code
> is missing a bounds check, but the name can never be long enough to
> trigger the overflow through normal operation.
> 
> I apologize for wasting your time on this. Thank you for the thorough
> debugging.
> 
> Best,
> Vova
> 
> On Sat, Aug 8, 2026 at 12:42 AM ChenXiaoSong 
> <[email protected] <mailto:[email protected]>> 
> wrote:
> 
>     Hi vova,
> 
>     I am using the same `ksmbd.conf` as you, the length of the netbios name
>     is 202.
> 
>     After debugging, I found that the maximum value of
>     `strlen(ksmbd_netbios_name())` is 15.
> 
>     ```
>     struct ksmbd_startup_request {
>              __s8    netbios_name[16];
>     }
>     ```
> 
>     I also checked the ksmbd-tools source code (Link[1]), and it copies at
>     most 15 characters:
>     ```
>     // ksmbd-tools.git
>     // mountd/ipc.c
>     static int ipc_ksmbd_starting_up(void)
>     {
>     ...
>              if (global_conf.netbios_name) {
>                      strncpy(ev->netbios_name,
>                              global_conf.netbios_name,
>                              sizeof(ev->netbios_name) - 1);
>              }
>     ...
>     }
> 
>     Link[1]:
>     https://github.com/cifsd-team/ksmbd-tools/blob/c0ce0753144adab006552ed42e6862758ed6929d/mountd/ipc.c#L162

-- 
ChenXiaoSong <[email protected]>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en