mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Gil PortnoyandSteve French
610346149d
Commit4b706360ff("ksmbd: fix multichannel binding and enforce channel limit") moved the binding-path session key out of the session-wide sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and sized both that buffer and the on-stack copy used during binding with SMB2_NTLMV2_SESSKEY_SIZE (16): struct channel { char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */ ... }; ntlm_authenticate() / krb5_authenticate(): char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */ char *auth_key = conn->binding ? channel_key : sess->sess_key; The two writers that fill this destination still bound the copy length against CIFS_KEY_SIZE (40), not against the 16-byte buffer: ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ return -EINVAL; arc4_crypt(ctx_arc4, sess_key, (char *)authblob + sess_key_off, sess_key_len); ksmbd_krb5_authenticate(): if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ ... memcpy(sess_key, resp->payload, resp->session_key_len); On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose session key is longer than 16 bytes (a normal AES256 key is 32), writes past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called from ksmbd_decode_ntlmssp_auth_blob(). The destinations must be able to hold the full session key the length checks already permit. Size the per-channel key buffer and the two on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key. Fixes:4b706360ff("ksmbd: fix multichannel binding and enforce channel limit") Signed-off-by: Gil Portnoy <dddhkts1@gmail.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
120 lines
3.3 KiB
C
120 lines
3.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Copyright (C) 2018 Samsung Electronics Co., Ltd.
|
|
*/
|
|
|
|
#ifndef __USER_SESSION_MANAGEMENT_H__
|
|
#define __USER_SESSION_MANAGEMENT_H__
|
|
|
|
#include <linux/hashtable.h>
|
|
#include <linux/xarray.h>
|
|
|
|
#include "../smb_common.h"
|
|
#include "../ntlmssp.h"
|
|
|
|
#define CIFDS_SESSION_FLAG_SMB2 BIT(1)
|
|
|
|
#define PREAUTH_HASHVALUE_SIZE 64
|
|
|
|
struct ksmbd_file_table;
|
|
|
|
struct channel {
|
|
char sess_key[CIFS_KEY_SIZE];
|
|
__u8 smb3signingkey[SMB3_SIGN_KEY_SIZE];
|
|
struct ksmbd_conn *conn;
|
|
};
|
|
|
|
struct preauth_session {
|
|
__u8 Preauth_HashValue[PREAUTH_HASHVALUE_SIZE];
|
|
u64 id;
|
|
struct list_head preauth_entry;
|
|
};
|
|
|
|
struct ksmbd_session {
|
|
u64 id;
|
|
|
|
__u16 dialect;
|
|
char ClientGUID[SMB2_CLIENT_GUID_SIZE];
|
|
|
|
struct ksmbd_user *user;
|
|
unsigned int sequence_number;
|
|
unsigned int flags;
|
|
|
|
bool sign;
|
|
bool enc;
|
|
|
|
int state;
|
|
__u8 *Preauth_HashValue;
|
|
|
|
char sess_key[CIFS_KEY_SIZE];
|
|
|
|
struct hlist_node hlist;
|
|
struct rw_semaphore chann_lock;
|
|
struct xarray ksmbd_chann_list;
|
|
struct xarray tree_conns;
|
|
struct ida tree_conn_ida;
|
|
struct xarray rpc_handle_list;
|
|
|
|
__u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE];
|
|
__u8 smb3decryptionkey[SMB3_ENC_DEC_KEY_SIZE];
|
|
__u8 smb3signingkey[SMB3_SIGN_KEY_SIZE];
|
|
|
|
struct ksmbd_file_table file_table;
|
|
unsigned long last_active;
|
|
struct rw_semaphore tree_conns_lock;
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
struct proc_dir_entry *proc_entry;
|
|
#endif
|
|
atomic_t refcnt;
|
|
struct rw_semaphore rpc_lock;
|
|
};
|
|
|
|
static inline int test_session_flag(struct ksmbd_session *sess, int bit)
|
|
{
|
|
return sess->flags & bit;
|
|
}
|
|
|
|
static inline void set_session_flag(struct ksmbd_session *sess, int bit)
|
|
{
|
|
sess->flags |= bit;
|
|
}
|
|
|
|
static inline void clear_session_flag(struct ksmbd_session *sess, int bit)
|
|
{
|
|
sess->flags &= ~bit;
|
|
}
|
|
|
|
struct ksmbd_session *ksmbd_smb2_session_create(void);
|
|
|
|
void ksmbd_session_destroy(struct ksmbd_session *sess);
|
|
|
|
struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id);
|
|
struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
|
|
unsigned long long id);
|
|
bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
|
|
unsigned long long id);
|
|
int ksmbd_session_register(struct ksmbd_conn *conn,
|
|
struct ksmbd_session *sess);
|
|
void ksmbd_sessions_deregister(struct ksmbd_conn *conn);
|
|
struct ksmbd_session *__session_lookup(unsigned long long id);
|
|
struct ksmbd_session *ksmbd_session_lookup_all(struct ksmbd_conn *conn,
|
|
unsigned long long id);
|
|
void destroy_previous_session(struct ksmbd_conn *conn,
|
|
struct ksmbd_user *user, u64 id);
|
|
struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
|
|
u64 sess_id);
|
|
struct preauth_session *ksmbd_preauth_session_lookup(struct ksmbd_conn *conn,
|
|
unsigned long long id);
|
|
|
|
int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess);
|
|
void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id);
|
|
|
|
int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name);
|
|
void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id);
|
|
int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id);
|
|
void ksmbd_user_session_get(struct ksmbd_session *sess);
|
|
void ksmbd_user_session_put(struct ksmbd_session *sess);
|
|
int create_proc_sessions(void);
|
|
#endif /* __USER_SESSION_MANAGEMENT_H__ */
|