From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:30:33 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=708793f83a7a54366f8d06ea6938cd769fa765bc;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch --- diff --git a/queue-7.1/ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch b/queue-7.1/ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch new file mode 100644 index 0000000000..5943c6fe2a --- /dev/null +++ b/queue-7.1/ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch @@ -0,0 +1,91 @@ +From 610346149d047a52a92c9a0eb329dd565b8f92c5 Mon Sep 17 00:00:00 2001 +From: Gil Portnoy +Date: Sun, 12 Jul 2026 00:00:00 +0000 +Subject: ksmbd: fix stack buffer overflow in multichannel session-key copy + +From: Gil Portnoy + +commit 610346149d047a52a92c9a0eb329dd565b8f92c5 upstream. + +Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel +limit") moved the binding-path session key out of the session-wide +sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and +sized both that buffer and the on-stack copy used during binding with +SMB2_NTLMV2_SESSKEY_SIZE (16): + + struct channel { + char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */ + ... + }; + + ntlm_authenticate() / krb5_authenticate(): + char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */ + char *auth_key = conn->binding ? channel_key : sess->sess_key; + +The two writers that fill this destination still bound the copy length +against CIFS_KEY_SIZE (40), not against the 16-byte buffer: + + ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): + if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ + return -EINVAL; + arc4_crypt(ctx_arc4, sess_key, + (char *)authblob + sess_key_off, sess_key_len); + + ksmbd_krb5_authenticate(): + if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ + ... + memcpy(sess_key, resp->payload, resp->session_key_len); + +On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, +so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 +bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose +session key is longer than 16 bytes (a normal AES256 key is 32), writes +past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. +KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called +from ksmbd_decode_ntlmssp_auth_blob(). + +The destinations must be able to hold the full session key the length +checks already permit. Size the per-channel key buffer and the two +on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key. + +Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") +Signed-off-by: Gil Portnoy +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/mgmt/user_session.h | 2 +- + fs/smb/server/smb2pdu.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/smb/server/mgmt/user_session.h ++++ b/fs/smb/server/mgmt/user_session.h +@@ -19,7 +19,7 @@ + struct ksmbd_file_table; + + struct channel { +- char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; ++ char sess_key[CIFS_KEY_SIZE]; + __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE]; + struct ksmbd_conn *conn; + }; +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1507,7 +1507,7 @@ static int ntlm_authenticate(struct ksmb + struct ksmbd_conn *conn = work->conn; + struct ksmbd_session *sess = work->sess; + struct ksmbd_user *user; +- char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; ++ char channel_key[CIFS_KEY_SIZE] = {}; + char *auth_key = conn->binding ? channel_key : sess->sess_key; + u64 prev_id; + bool binding = conn->binding; +@@ -1644,7 +1644,7 @@ static int krb5_authenticate(struct ksmb + struct ksmbd_conn *conn = work->conn; + struct ksmbd_session *sess = work->sess; + char *in_blob, *out_blob; +- char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; ++ char channel_key[CIFS_KEY_SIZE] = {}; + char *auth_key = conn->binding ? channel_key : sess->sess_key; + u64 prev_sess_id; + bool binding = conn->binding; diff --git a/queue-7.1/series b/queue-7.1/series index d8ac7bcef8..6ed8d631c5 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1937,3 +1937,4 @@ ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch octeontx2-af-cn10k-restrict-vf-lmtline-sharing-to-its-own-pf.patch +ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch