ksmbd: fix heap out-of-bounds write in krb5_authenticate()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.16, 6.2, 6.5, 6.6.160, 6.12.114, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects the Linux kernel's ksmbd, the in-kernel SMB server used for file sharing, specifically its Kerberos authentication path during SMB2 session setup. An attacker who can send crafted compound SMB requests could corrupt adjacent kernel heap memory, which may crash the system or lead to privilege escalation.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Linux Linux
From 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 · fixed in 59c6dcc5dd9dafe764ca0d40525933b2be69b059; From 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 · fixed in 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a; From 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 · fixed in 517404e157395d0f8da125ca956c566895dfcd06; From 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 · fixed in 4722d06b2907585074252061b1024a696c1cfc23; From 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 · fixed in 23a0be6a84a38ac169eeab49017934e8e27c65f0; From 5.15.145 · fixed in 5.16; From 6.1.40 · fixed in 6.2; From 6.4.5 · fixed in 6.5
- Linux Linux
6.5
- KernelLinux
fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.58; From 6.19.0 · fixed in 7.2.12