| Message ID | 20231215225914.20065-1-pc@manguebit.com |
|---|---|
| State | New |
| Headers | show |
| Series | smb: client: fix OOB in smbCalcSize() | expand |
Good catch. updated cifs-2.6.git for-next with this patch and added Cc: stable On Fri, Dec 15, 2023 at 4:59 PM Paulo Alcantara <pc@manguebit.com> wrote: > > Validate @smb->WordCount to avoid reading off the end of @smb and thus > causing the following KASAN splat: > > BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs] > Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328 > > CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS > rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 > Call Trace: > <TASK> > dump_stack_lvl+0x4a/0x80 > print_report+0xcf/0x650 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? __phys_addr+0x46/0x90 > kasan_report+0xd8/0x110 > ? smbCalcSize+0x32/0x40 [cifs] > ? smbCalcSize+0x32/0x40 [cifs] > kasan_check_range+0x105/0x1b0 > smbCalcSize+0x32/0x40 [cifs] > checkSMB+0x162/0x370 [cifs] > ? __pfx_checkSMB+0x10/0x10 [cifs] > cifs_handle_standard+0xbc/0x2f0 [cifs] > ? srso_alias_return_thunk+0x5/0xfbef5 > cifs_demultiplex_thread+0xed1/0x1360 [cifs] > ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] > ? srso_alias_return_thunk+0x5/0xfbef5 > ? lockdep_hardirqs_on_prepare+0x136/0x210 > ? __pfx_lock_release+0x10/0x10 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? mark_held_locks+0x1a/0x90 > ? lockdep_hardirqs_on_prepare+0x136/0x210 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? __kthread_parkme+0xce/0xf0 > ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] > kthread+0x18d/0x1d0 > ? kthread+0xdb/0x1d0 > ? __pfx_kthread+0x10/0x10 > ret_from_fork+0x34/0x60 > ? __pfx_kthread+0x10/0x10 > ret_from_fork_asm+0x1b/0x30 > </TASK> > > This fixes CVE-2023-6606. > > Reported-by: j51569436@gmail.com > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218 > Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> > --- > fs/smb/client/misc.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c > index 35b176457bbe..c2137ea3c253 100644 > --- a/fs/smb/client/misc.c > +++ b/fs/smb/client/misc.c > @@ -363,6 +363,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) > cifs_dbg(VFS, "Length less than smb header size\n"); > } > return -EIO; > + } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { > + cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", > + __func__, smb->WordCount); > + return -EIO; > } > > /* otherwise, there is enough to get to the BCC */ > -- > 2.43.0 >
diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c index 35b176457bbe..c2137ea3c253 100644 --- a/fs/smb/client/misc.c +++ b/fs/smb/client/misc.c @@ -363,6 +363,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) cifs_dbg(VFS, "Length less than smb header size\n"); } return -EIO; + } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { + cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", + __func__, smb->WordCount); + return -EIO; } /* otherwise, there is enough to get to the BCC */
Validate @smb->WordCount to avoid reading off the end of @smb and thus causing the following KASAN splat: BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs] Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328 CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __phys_addr+0x46/0x90 kasan_report+0xd8/0x110 ? smbCalcSize+0x32/0x40 [cifs] ? smbCalcSize+0x32/0x40 [cifs] kasan_check_range+0x105/0x1b0 smbCalcSize+0x32/0x40 [cifs] checkSMB+0x162/0x370 [cifs] ? __pfx_checkSMB+0x10/0x10 [cifs] cifs_handle_standard+0xbc/0x2f0 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 cifs_demultiplex_thread+0xed1/0x1360 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? __pfx_lock_release+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? mark_held_locks+0x1a/0x90 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __kthread_parkme+0xce/0xf0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x18d/0x1d0 ? kthread+0xdb/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> This fixes CVE-2023-6606. Reported-by: j51569436@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218 Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> --- fs/smb/client/misc.c | 4 ++++ 1 file changed, 4 insertions(+)