Linux Kernel ksmbd Out-of-Bounds Read Vulnerability in smb_check_perm_dacl()

A vulnerability has been identified in the Linux kernel's ksmbd component, specifically within the smb_check_perm_dacl() function. This issue arises from a transposed bounds check introduced in a previous commit, which effectively created dead code by allowing an invalid comparison that never breaks the loop. As a result, the function can read memory out-of-bounds, reopening a previously patched heap corruption issue. This out-of-bounds read occurs during SMB2_CREATE operations, potentially leading to memory disclosure or corruption.

Impact

Exploitation of this vulnerability causes a heap-based out-of-bounds read, allowing for memory to be read beyond the allocated bounds, which could lead to information disclosure or memory corruption.

Reproduction

The vulnerability can be reproduced by performing operations that trigger the smb_check_perm_dacl() function in the ksmbd component of the Linux kernel. This can be done by creating an SMB share with a custom Access Control List (ACL) that includes Access Control Entries (ACEs) of varying sizes, particularly those that would cause the aces_size variable to be less than the expected minimum. Once the ACL is set, initiate an SMB2_CREATE operation, which will invoke the vulnerable function and cause the out-of-bounds read.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. The specific commit that addresses this issue is available in the Linux kernel stable tree.