Commit 3baaef8c authored Jan 18, 2023 by William Liu Committed by openeuler-sync-bot Jan 19, 2023

ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob

mainline inclusion
from mainline-v6.2-rc4
commit 797805d8
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6A0GH
CVE: CVE-2023-0210

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=797805d81baa814f76cf7bdab35f86408a79d707



--------------------------------

"nt_len - CIFS_ENCPWD_SIZE" is passed directly from
ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests
can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative
number (or large unsigned value) used for a subsequent memcpy in
ksmbd_auth_ntlvm2 and can cause a panic.

Fixes: e2f34481 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: William Liu <will@willsroot.io>
Signed-off-by: Hrvoje Mišetić <misetichrvoje@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
(cherry picked from commit 3c316171)

parent 14c74d92

fs/ksmbd/auth.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -321,7 +321,8 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
		dn_off = le32_to_cpu(authblob->DomainName.BufferOffset);
		dn_len = le16_to_cpu(authblob->DomainName.Length);

		if (blob_len < (u64)dn_off + dn_len \|\| blob_len < (u64)nt_off + nt_len)
		if (blob_len < (u64)dn_off + dn_len \|\| blob_len < (u64)nt_off + nt_len \|\|
		nt_len < CIFS_ENCPWD_SIZE)
		return -EINVAL;

		/* TODO : use domain name that imported from configuration file */