From patchwork Thu Jan 25 21:44:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1891036 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TLZ9F4CZrz23gC for ; Fri, 26 Jan 2024 08:44:32 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rT7WK-0005kH-EI; Thu, 25 Jan 2024 21:44:24 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rT7WF-0005jo-QM for kernel-team@lists.ubuntu.com; Thu, 25 Jan 2024 21:44:19 +0000 Received: from mail-io1-f71.google.com (mail-io1-f71.google.com [209.85.166.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 9B7633F283 for ; Thu, 25 Jan 2024 21:44:19 +0000 (UTC) Received: by mail-io1-f71.google.com with SMTP id ca18e2360f4ac-7baa6cc3af2so725542039f.2 for ; Thu, 25 Jan 2024 13:44:19 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706219058; x=1706823858; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+N94g8vyrhQZIt4NoYrJaQ6qCtu7NJsJ334vxrzIhQg=; b=TEVWMXQm8Ev4VQrM8evmceCGQk8PtlMEurDaHmWZKXIH9lC1/rXyVtHzIABlMgxJfD L+9aRJ7m0X+fPaHVDL+Le3w3tI9ZuDKUVE2JjYpOWpILRouUkB9jjgLi4i7L0FahxHZF CpMyBH+8kL/qqg3YNagkERp3YwwZXqv3267+rXDncWNpd4t0nzHdK3k5QUA007VcoxgO oj7qq6oi/sgZ5MFVJahfYCPL6qRzFhWTx9Cujwq14uZ2Ppaz3xhh8U3f1hkSrKj2jQlv cgqTYxpUt7rsr6wQeuPk166TvPTtDWvHndI1ncPqxk4ozPOPGsbcOJ5zO6T4t+ttLE0/ r1UQ== X-Gm-Message-State: AOJu0YxJBjjnM47yH9XldNYFM50GgoYZlz7dTZwk8DZcs8TdT6kDuqfn R8+BlLJuyfmiXeCR752Y6jWbp9Zc5Na3P8M5ZGBcyuzojTirwFkm9PUCw+wA1QHmq68v9G88DF3 2JpUzcrS8CXKIzUDdnp2uGp6ZJdmF94D1d4Sv8xsuBCl1GE3yL0dv6Abq0lgcemQujpIZqjb1+d LTnisVM02eWA== X-Received: by 2002:a6b:e31a:0:b0:7bf:2bb8:17e1 with SMTP id u26-20020a6be31a000000b007bf2bb817e1mr487846ioc.15.1706219058263; Thu, 25 Jan 2024 13:44:18 -0800 (PST) X-Google-Smtp-Source: AGHT+IFs6A0icnKqFjzc6TgSi7LsHYIu+gpJYigTGuE4trDzBjXFMjjXt9MTavt77X6yr/bPmWE9Qg== X-Received: by 2002:a6b:e31a:0:b0:7bf:2bb8:17e1 with SMTP id u26-20020a6be31a000000b007bf2bb817e1mr487838ioc.15.1706219057947; Thu, 25 Jan 2024 13:44:17 -0800 (PST) Received: from smtp.gmail.com (104-218-69-19.dynamic.lnk.ne.allofiber.net. [104.218.69.19]) by smtp.gmail.com with ESMTPSA id y63-20020a029545000000b0046e77bd393dsm5008369jah.144.2024.01.25.13.44.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jan 2024 13:44:17 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][Jammy][PATCH 1/1] ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop Date: Thu, 25 Jan 2024 15:44:15 -0600 Message-Id: <20240125214415.27231-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240125214415.27231-1-bethany.jamison@canonical.com> References: <20240125214415.27231-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Namjae Jeon The length field of netbios header must be greater than the SMB header sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet. If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. In the function `get_smb2_cmd_val` ksmbd will read cmd from `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN detector to print the following error message: [ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 [ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248 ... [ 7.207125] [ 7.209191] get_smb2_cmd_val+0x45/0x60 [ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 [ 7.209712] ksmbd_server_process_request+0x72/0x160 [ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 [ 7.212280] kthread+0x160/0x190 [ 7.212762] ret_from_fork+0x1f/0x30 [ 7.212981] Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang Signed-off-by: Namjae Jeon Signed-off-by: Steve French (backported from commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0) [bjamison: Jammy was missing the definition of smb2_get_msg function which was used in the fix commit - function definition was very simple so I added it] CVE-2023-38431 Signed-off-by: Bethany Jamison --- fs/ksmbd/connection.c | 12 ++++++++++++ fs/ksmbd/smb2pdu.h | 9 +++++++++ 2 files changed, 21 insertions(+) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index 3c4b7a96919ce..33d9f6ade7004 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -263,6 +263,9 @@ bool ksmbd_conn_alive(struct ksmbd_conn *conn) return true; } +#define SMB1_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb_hdr)) +#define SMB2_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb2_hdr) + 4) + /** * ksmbd_conn_handler_loop() - session thread to listen on new smb requests * @p: connection instance @@ -319,6 +322,9 @@ int ksmbd_conn_handler_loop(void *p) if (pdu_size > MAX_STREAM_PROT_LEN) break; + if (pdu_size < SMB1_MIN_SUPPORTED_HEADER_SIZE) + break; + /* 4 for rfc1002 length field */ /* 1 for implied bcc[0] */ size = pdu_size + 4 + 1; @@ -346,6 +352,12 @@ int ksmbd_conn_handler_loop(void *p) continue; } + if (((struct smb2_hdr *)smb2_get_msg(conn->request_buf))->ProtocolId == + SMB2_PROTO_NUMBER) { + if (pdu_size < SMB2_MIN_SUPPORTED_HEADER_SIZE) + break; + } + if (!default_conn_ops.process_fn) { pr_err("No connection request callback\n"); break; diff --git a/fs/ksmbd/smb2pdu.h b/fs/ksmbd/smb2pdu.h index fa1cd556ab7ac..c8cc1083d3c81 100644 --- a/fs/ksmbd/smb2pdu.h +++ b/fs/ksmbd/smb2pdu.h @@ -1707,4 +1707,13 @@ int smb2_ioctl(struct ksmbd_work *work); int smb2_oplock_break(struct ksmbd_work *work); int smb2_notify(struct ksmbd_work *ksmbd_work); +/* + * Get the body of the smb2 message excluding the 4 byte rfc1002 headers + * from request/response buffer. + */ +static inline void *smb2_get_msg(void *buf) +{ + return buf + 4; +} + #endif /* _SMB2PDU_H */