https://github.com/torvalds/linux
Revision e7067a446264a7514fa1cfaa4052cdb6803bc6a2 authored by David Disseldorp on 13 April 2023, 14:49:57 UTC, committed by Steve French on 13 April 2023, 19:17:32 UTC
Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within
the SMB request boundary; deassemble_neg_contexts() only checks that the
eight byte smb2_neg_context header + (client controlled) DataLength are
within the packet boundary, which is insufficient.

Checking for sizeof(struct smb2_preauth_neg_context) is overkill given
that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
1 parent 09a9639
History
Tip revision: e7067a446264a7514fa1cfaa4052cdb6803bc6a2 authored by David Disseldorp on 13 April 2023, 14:49:57 UTC
ksmbd: avoid out of bounds access in decode_preauth_ctxt()
Tip revision: e7067a4
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
io_uring
ipc
kernel
lib
mm
net
rust
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 20.0 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 151 bytes
.gitattributes -rw-r--r-- 90 bytes
.gitignore -rw-r--r-- 2.1 KB
.mailmap -rw-r--r-- 26.9 KB
.rustfmt.toml -rw-r--r-- 369 bytes
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 99.7 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 684.8 KB
Makefile -rw-r--r-- 70.0 KB
README -rw-r--r-- 727 bytes

README

back to top