Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: resolve SWN tcon from live registrations<br /> <br /> cifs_swn_notify() looks up a witness registration by id under<br /> cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration&amp;#39;s<br /> cached tcon pointer. That pointer is not a lifetime reference, and it is<br /> not a stable representative once cifs_get_swn_reg() lets multiple tcons<br /> for the same net/share name share one registration id.<br /> <br /> A same-share second mount can keep the cifs_swn_reg alive after the first<br /> tcon unregisters and is freed. The registration then still points at the<br /> freed first tcon, so taking tc_lock or incrementing tc_count through<br /> swnreg-&gt;tcon only moves the use-after-free earlier. Taking tc_lock while<br /> holding cifs_swnreg_idr_mutex also violates the documented CIFS lock<br /> order.<br /> <br /> Fix this by making the registration store only the stable witness<br /> identity: id, net name, share name, and notify flags. When a notify<br /> arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,<br /> then find and pin a live witness tcon that currently matches the net/share<br /> pair under the normal cifs_tcp_ses_lock -&gt; tc_lock order. The notification<br /> path uses that pinned tcon directly and drops the reference when done.<br /> <br /> Registration and unregister messages now use the live tcon passed by the<br /> caller instead of a cached tcon in the registration. The final unregister<br /> send is folded into cifs_swn_unregister() while the registration is still<br /> protected by cifs_swnreg_idr_mutex. This removes the previous<br /> find/drop/reacquire raw-pointer window. The release path only removes the<br /> idr entry and frees the stable identity strings.<br /> <br /> This preserves the intended one-registration/many-tcon behavior: a<br /> registration id represents a net/share pair, and notify handling acts on a<br /> live representative selected at use time. It also preserves CLIENT_MOVE<br /> ordering for the representative tcon because the old-IP unregister is sent<br /> before cifs_swn_register() sends the new-IP register.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()<br /> <br /> When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls<br /> smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring<br /> buffer pages. It derives pg_idx = head &gt;&gt; PAGE_SHIFT from @head, which is<br /> handle-&gt;head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages<br /> normalization is only applied after the first loop iteration.<br /> <br /> This leaves the initial page index underived from the buffer size, which<br /> can result in an out-of-bounds write past dst_pages[] when head exceeds<br /> the AUX buffer size.<br /> <br /> Normalize head modulo the AUX buffer size before deriving the page index<br /> and offset, mirroring tmc_etr_sync_perf_buffer().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: L2CAP: validate option length before reading conf opt value<br /> <br /> l2cap_get_conf_opt() derives the option length from the<br /> attacker-controlled opt-&gt;len field and immediately dereferences<br /> opt-&gt;val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a<br /> raw pointer for the default case) before any caller has confirmed<br /> that opt-&gt;len bytes are present in the buffer. The callers<br /> (l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and<br /> l2cap_conf_rfc_get()) only detect a malformed option afterwards, once<br /> the running length has gone negative, by which point the<br /> out-of-bounds read has already executed.<br /> <br /> An existing post-hoc length check keeps the garbage value from being<br /> consumed, so this is not a data leak in the current control flow. It<br /> is still a validate-after-use ordering bug: up to 4 bytes are read<br /> past the end of the buffer before it is known to contain them, and it<br /> is fragile to future changes in the callers.<br /> <br /> Fix it at the source. Pass the end of the buffer into<br /> l2cap_get_conf_opt() and refuse to touch opt-&gt;val unless the full<br /> option (header + value) fits. Each caller computes an end pointer<br /> once before the loop and checks the return value directly instead of<br /> inferring the error from a negative length.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix query directory replay double-free<br /> <br /> A response-bearing attempt can return a replayable error and free its<br /> response buffer. If SMB2_query_directory_init() fails before the next send,<br /> cleanup retains the previous buffer type and frees that response again.<br /> <br /> Reset response bookkeeping before each attempt to prevent the stale free.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb/client: fix chown/chgrp with SMB3 POSIX Extensions<br /> <br /> Ownership (chown) and group (chgrp) modifications were being ignored when<br /> mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or<br /> CIFS_MOUNT_MODE_FROM_SID were also explicitly set.<br /> <br /> Fix this by checking for posix_extensions in cifs_setattr_nounix() when<br /> updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map<br /> and set the ownership/group information on the server.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate NTLMv2 response before updating session key<br /> <br /> ksmbd_auth_ntlmv2() derives the NTLMv2 session key into<br /> sess-&gt;sess_key before it verifies the NTLMv2 response.<br /> ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even<br /> when ksmbd_auth_ntlmv2() failed.<br /> <br /> With SMB3 multichannel binding, the failed authentication operates on<br /> an existing session and the session setup error path does not expire<br /> binding sessions. A client can send a binding session setup with a<br /> bad NT proof and KEY_XCH and still modify sess-&gt;sess_key before<br /> STATUS_LOGON_FAILURE is returned.<br /> <br /> Relevant path:<br /> <br /> smb2_sess_setup()<br /> -&gt; conn-&gt;binding = true<br /> -&gt; ntlm_authenticate()<br /> -&gt; session_user()<br /> -&gt; ksmbd_decode_ntlmssp_auth_blob()<br /> -&gt; ksmbd_auth_ntlmv2()<br /> -&gt; calc_ntlmv2_hash()<br /> -&gt; hmac_md5_usingrawkey(..., sess-&gt;sess_key)<br /> -&gt; crypto_memneq() returns mismatch<br /> -&gt; KEY_XCH arc4_crypt(..., sess-&gt;sess_key, ...)<br /> -&gt; out_err without expiring the binding session<br /> <br /> Derive the base session key into a local buffer and copy it to<br /> sess-&gt;sess_key only after the proof matches. Return immediately on<br /> authentication failure so KEY_XCH is only processed after successful<br /> authentication.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: track the connection owning a byte-range lock<br /> <br /> SMB2_LOCK adds each granted byte-range lock to both the file lock list<br /> and the lock list of the connection which handled the request. The<br /> final close and durable handle paths, however, remove the connection<br /> list entry while holding fp-&gt;conn-&gt;llist_lock.<br /> <br /> With SMB3 multichannel, the connection handling the LOCK request can be<br /> different from the connection which opened the file. The entry can<br /> therefore be removed under a different spinlock from the one protecting<br /> the list it belongs to. A concurrent traversal can then access freed<br /> struct ksmbd_lock and struct file_lock objects.<br /> <br /> Record the connection owning each lock&amp;#39;s clist entry and hold a<br /> reference to it while the entry is linked. Use that connection and its<br /> llist_lock for unlock, rollback, close, and durable preserve. Durable<br /> reconnect assigns the new connection as the owner when publishing the<br /> locks again.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: use opener credentials for ADS I/O<br /> <br /> Alternate data streams are stored as xattrs. Unlike regular file I/O,<br /> their read and write paths therefore call VFS xattr helpers which recheck<br /> inode permissions and LSM policy using the current task credentials.<br /> <br /> Run ADS I/O with the credentials captured when the SMB handle was opened.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: use opener credentials for delete-on-close<br /> <br /> Delete-on-close can be completed by deferred or durable handle teardown,<br /> where no request work is available. Both the base-file unlink and the ADS<br /> xattr removal consequently run with the ksmbd worker credentials and can<br /> bypass filesystem permission checks.<br /> <br /> Run both operations with the credentials captured in struct file when the<br /> handle was opened. This preserves the authenticated user&amp;#39;s fsuid, fsgid,<br /> supplementary groups and capability restrictions at final close.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: run set info with opener credentials<br /> <br /> SMB2 SET_INFO handlers call path-based VFS helpers after checking the<br /> access mask granted to the SMB handle. Those helpers perform their owner,<br /> inode permission and LSM checks using the current ksmbd worker credentials.<br /> <br /> Run the complete SET_INFO dispatch with the credentials captured when the<br /> handle was opened. This also removes the separate security information<br /> credential setup and keeps all SET_INFO classes under one credential scope.<br /> <br /> Direct override_creds() is used because it can nest with the request<br /> credential overrides already used by rename and link helpers.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY<br /> <br /> commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a<br /> permission check for FSCTL_SET_SPARSE") added a fp-&gt;daccess gate to<br /> fsctl_set_sparse and noted that "similar handle-level checks exist in other<br /> functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of<br /> the missing ones, and the most security-relevant: smb2_set_info_sec() calls<br /> set_info_sec() with no per-handle access check.<br /> <br /> set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it<br /> rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via<br /> set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and<br /> rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().<br /> Every other persistent-mutation arm of the sibling handler<br /> smb2_set_info_file() checks fp-&gt;daccess first (FILE_WRITE_DATA /<br /> FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —<br /> which mutates the access control itself — is the only one with no gate.<br /> <br /> A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no<br /> FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType<br /> SMB2_O_INFO_SECURITY to rewrite the file&amp;#39;s DACL and owner, granting itself<br /> access the handle&amp;#39;s daccess never carried. Unlike the FSCTL data arms this<br /> is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —<br /> the missing fp-&gt;daccess check is the entire gate.<br /> <br /> Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so<br /> require at least one of those on the handle before re-permissioning the<br /> file. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: require source read access for duplicate extents<br /> <br /> FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to<br /> vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB<br /> access mask granted to the source handle. A handle opened with attribute<br /> access can consequently be used to copy file contents into an<br /> attacker-readable destination.<br /> <br /> Require FILE_READ_DATA on the source handle before either VFS operation,<br /> matching other ksmbd data-copy paths.