Linux kernel (ksmbd) vulnerabilities

In the Linux kernel's SMB server (ksmbd), the buffer returned by ksmbd_ipc_login_request_ext() was not freed after ksmbd_alloc_user() calls, causing a memory leak visible in kmemleak. The fix frees this buffer unconditionally.

In the Linux kernel's ksmbd module, ipc_validate_msg() reads length fields (payload_sz, session_key_len, ngroups) from the response buffer supplied by the userspace ksmbd daemon before verifying the buffer is large enough. A short response causes an out-of-bounds read past the end of the allocation, triggering a KASAN slab-out-of-bounds error.

In the Linux kernel's ksmbd module, preauthentication sessions (preauth_session) were not freed on connection teardown. If a client disconnected before sending the authenticate request, the object allocated during NTLM negotiate was not freed by either the authenticate or error cleanup paths, causing a memory leak.

In the Linux kernel's ksmbd module, close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without serializing the close transition with bit acquisition, close can become a new break owner through the test_and_set_bit() fast path and overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT, continuing a break for a dying opinfo.

In the ksmbd module of the Linux kernel, a file_lock lifetime flaw exists. Retained file_lock objects can still be part of the VFS blocked-request graph, and freeing them directly triggers BUG_ON(!list_empty(&flc->flc_blocked_requests)) and can leave a freed ksmbd_lock reachable.

In the ksmbd module of the Linux kernel, ksmbd_all_conn_set_status() treats every connection with the transient binding flag set as belonging to the target SessionId. As a result, a logoff or session replacement can move an unrelated connection to NEED_RECONNECT or NEED_SETUP.

In the ksmbd module of the Linux kernel, ksmbd_session_register() fails to remove the session from sessions_table and drop its table reference when xa_store() fails. This causes a session leak because the reference count stays at 1 and the session is not freed.

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.

In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.

An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.

A flaw in the Linux kernel's ksmbd module related to DACL permission checks has been fixed. The access control logic did not consider an Authenticated Users ACE (S-1-5-11), causing files accessible to authenticated users to incorrectly fail with STATUS_ACCESS_DENIED. Additionally, maximal access calculation combined access masks from all ACEs regardless of whether their SID applied to the current user, potentially granting rights belonging to unrelated principals.

In the Linux kernel's ksmbd module, check_lock_range() uses inclusive ranges, so start == end represents a valid single-byte range rather than an empty range. The start == end shortcut skipped mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges, allowing the operation to proceed despite a conflicting lock.

A slab-out-of-bounds read vulnerability exists in the ksmbd module of the Linux kernel in the ksmbd_alloc_user() function. The function copies resp->hash_sz bytes from the mountd IPC login response, where hash_sz is a __u16 supplied by the response and is not validated against the size of the hash[] buffer (KSMBD_REQ_MAX_HASH_SZ). A malformed or malicious login response can set hash_sz up to 65535, causing the memcpy() to read past the end of the response object.

In the ksmbd module of the Linux kernel, a lock ordering flaw occurs when a lock is deferred. When vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on rollback_list before allocating and registering the asynchronous work; if that setup fails, rollback dereferences NULL and frees a file_lock still linked into the VFS blocked-lock state.

In the ksmbd module of the Linux kernel, smb_check_perm_dacl() bounds its ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). A crafted DACL can place an access-granting ACE beyond pdacl->size, which is accepted during SMB2_CREATE access validation.

A vulnerability has been identified in the Linux kernel that allowed for out-of-bounds writes when processing compound requests in ksmbd. The issue occurred when the first command in a request consumed most of the response buffer, leading to errors in building the security descriptor.