Linux Kernel ksmbd Out-of-Bounds Read Vulnerability in smb_check_perm_dacl

A heap out-of-bounds read vulnerability has been identified in the Linux kernel's ksmbd component, specifically within the smb_check_perm_dacl() function. This issue arises because the function validates the size of the Access Control Entry (ACE) header and limits the number of sub-authorities in Security Identifiers (SIDs) to a maximum value. However, it fails to ensure that the ACE size is sufficient to accommodate the specified number of sub-authorities before dereferencing them. An attacker can exploit this oversight by crafting an ACE that manipulates the SID revision and authority bytes, forcing the function to read beyond the allocated memory, potentially leading to memory corruption or information disclosure.

Impact

Exploitation of this vulnerability causes a heap-based out-of-bounds read, where data is read past the allocated buffer, potentially leading to information disclosure or memory corruption.

Reproduction

The vulnerability can be reproduced by creating a crafted ACE with a size of 16 bytes and at least one sub-authority, and placing it at the end of a security descriptor. This malformed descriptor can be written to a file's security attributes using the SMB2_SET_INFO command. Once the descriptor is written, the vulnerability can be triggered by performing an SMB2_CREATE operation, which will invoke the smb_check_perm_dacl() function and cause the out-of-bounds read.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for upgrading can be found in the official Linux kernel documentation.