Linux kernel (ksmbd) vulnerabilities

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.

The ksmbd module in the Linux kernel has a signedness bug in smb_direct_prepare_negotiation(). An unsigned __u32 value from preferred_send_size is cast to a signed int before computing min_t(int, ...), so a malicious value of 0x80000000 is treated as smaller than max_recv_size and used to set the maximum allowed receive size. By sending a second message with a large value (>1420 bytes), the attacker can achieve a heap buffer overflow.

A use-after-free vulnerability exists in the Linux kernel ksmbd module involving the share_conf object in compound requests. smb2_get_ksmbd_tcon() reuses work->tcon without validating tcon->t_state, so after an earlier SMB2_TREE_DISCONNECT frees share_conf, subsequent commands dereference the freed memory.

In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.

An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.

In the Linux kernel, the ksmbd (SMB server) module mishandles SMB2 session expiration. The ksmbd_session_register() function destroyed valid sessions after ten seconds of inactivity whenever a client started another SessionSetup exchange, confusing Session.IdleTime with Session.ExpirationTime. This invalidated tree connects and caused mapped drives to fail with STATUS_NETWORK_NAME_DELETED.

A flaw in the Linux kernel's ksmbd module related to DACL permission checks has been fixed. The access control logic did not consider an Authenticated Users ACE (S-1-5-11), causing files accessible to authenticated users to incorrectly fail with STATUS_ACCESS_DENIED. Additionally, maximal access calculation combined access masks from all ACEs regardless of whether their SID applied to the current user, potentially granting rights belonging to unrelated principals.

In the Linux kernel's ksmbd module, check_lock_range() uses inclusive ranges, so start == end represents a valid single-byte range rather than an empty range. The start == end shortcut skipped mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges, allowing the operation to proceed despite a conflicting lock.

In the Linux kernel's SMB server (ksmbd), the buffer returned by ksmbd_ipc_login_request_ext() was not freed after ksmbd_alloc_user() calls, causing a memory leak visible in kmemleak. The fix frees this buffer unconditionally.

A slab-out-of-bounds read vulnerability exists in the ksmbd module of the Linux kernel in the ksmbd_alloc_user() function. The function copies resp->hash_sz bytes from the mountd IPC login response, where hash_sz is a __u16 supplied by the response and is not validated against the size of the hash[] buffer (KSMBD_REQ_MAX_HASH_SZ). A malformed or malicious login response can set hash_sz up to 65535, causing the memcpy() to read past the end of the response object.

In the Linux kernel's ksmbd module, ipc_validate_msg() reads length fields (payload_sz, session_key_len, ngroups) from the response buffer supplied by the userspace ksmbd daemon before verifying the buffer is large enough. A short response causes an out-of-bounds read past the end of the allocation, triggering a KASAN slab-out-of-bounds error.

In the Linux kernel's ksmbd module, preauthentication sessions (preauth_session) were not freed on connection teardown. If a client disconnected before sending the authenticate request, the object allocated during NTLM negotiate was not freed by either the authenticate or error cleanup paths, causing a memory leak.

In the Linux kernel's ksmbd module, close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without serializing the close transition with bit acquisition, close can become a new break owner through the test_and_set_bit() fast path and overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT, continuing a break for a dying opinfo.

In the ksmbd module of the Linux kernel, a lock ordering flaw occurs when a lock is deferred. When vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on rollback_list before allocating and registering the asynchronous work; if that setup fails, rollback dereferences NULL and frees a file_lock still linked into the VFS blocked-lock state.

In the ksmbd module of the Linux kernel, a file_lock lifetime flaw exists. Retained file_lock objects can still be part of the VFS blocked-request graph, and freeing them directly triggers BUG_ON(!list_empty(&flc->flc_blocked_requests)) and can leave a freed ksmbd_lock reachable.

In the ksmbd module of the Linux kernel, ksmbd_all_conn_set_status() treats every connection with the transient binding flag set as belonging to the target SessionId. As a result, a logoff or session replacement can move an unrelated connection to NEED_RECONNECT or NEED_SETUP.

In the ksmbd module of the Linux kernel, smb_check_perm_dacl() bounds its ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). A crafted DACL can place an access-granting ACE beyond pdacl->size, which is accepted during SMB2_CREATE access validation.

In the ksmbd module of the Linux kernel, ksmbd_session_register() fails to remove the session from sessions_table and drop its table reference when xa_store() fails. This causes a session leak because the reference count stays at 1 and the session is not freed.

In the Linux kernel, ksmbd's ipc_validate_msg() computes the expected message size by adding or multiplying attacker-controlled fields (payload_sz, ngroups) to a fixed struct size in unsigned int arithmetic. This can cause an integer overflow that bypasses the size check, after which downstream consumers trust the unverified length in memcpy/kmemdup. The flaw is the response-side analogue of an earlier request-side fix.

In the Linux kernel, ksmbd's smb_inherit_dacl() trusted the num_aces value from the parent directory's DACL xattr without validating it against pdacl_size. An authenticated client could tamper with the security.NTACL attribute to set num_aces = 65535, causing a large (~8 MB) uninitialized allocation and potential overflow on 32-bit kernels. The fix validates num_aces, uses overflow-safe kmalloc_array, and tightens ACE size checks.

A vulnerability has been identified in the Linux kernel that allowed for out-of-bounds writes when processing compound requests in ksmbd. The issue occurred when the first command in a request consumed most of the response buffer, leading to errors in building the security descriptor.

In the Linux kernel SMB server module (ksmbd), a deadlock occurs when smb2_create_link() is called with ReplaceIfExists set and the target name already exists. ksmbd_vfs_kern_path_locked() returns success with the parent directory locked, and then ksmbd_vfs_link() tries to lock the same parent again, causing a deadlock.

The ksmbd module in the Linux kernel lacks a check for simultaneous SMB operations. A client sending many simultaneous SMB operations can exhaust memory through ksmbd_work_cache, causing an OOM issue. The ksmbd credit mechanism cannot handle this, so the fix adds a check for exceeding max credits by assuming each SMB request consumes at least one credit.