Linux Kernel ksmbd Component Compound Request Session Validation Vulnerability

A vulnerability in the Linux kernel's ksmbd component allows for improper session validation in compound requests. The issue arises because the function smb2_check_user_session() does not correctly verify the session state for non-first operations in a COMPOUND request. Instead, it reuses the session from the first operation, validates only the SessionId, and returns 'valid' without checking if the session is actually valid. This oversight can be exploited by initiating a SESSION_SETUP with an NTLM Type-1 blob, which creates a new session in progress. When this session is used in a compound request with a TREE_CONNECT operation, it leads to a NULL-pointer dereference and a kernel Oops, causing a denial of service by disrupting the ksmbd worker for all clients.

Impact

Exploitation of this vulnerability causes a NULL-pointer dereference, leading to a kernel Oops that disrupts the ksmbd worker for all clients.

Reproduction

To reproduce this vulnerability, first establish a SESSION_SETUP operation that includes an NTLM Type-1 (NtLmNegotiate) blob. This will create a new SMB2_SESSION_IN_PROGRESS session, but the session's user field will remain NULL. Next, initiate a COMPOUND request where the first operation is the SESSION_SETUP and the second operation is TREE_CONNECT, targeting the IPC$ share on a specified host. The TREE_CONNECT operation will be processed using the IN_PROGRESS session, which lacks a valid user assignment. This will trigger the NULL-pointer dereference by accessing the user_name function with the NULL user field, causing the kernel Oops error.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.