Re: ZDI-CAN-33549: New Vulnerability Report

[Stefan Metzmacher]

Am 22.10.26 um 00:16 schrieb Stefan Metzmacher via samba-technical:
> Hi HYEONTAE LEE,
>
> would you be able to test if this is reproducable on this branch:
> https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/for-7.5/smbdirect
> git clone -b for-7.5/smbdirect  https://git.samba.org/metze/linux/wip.git for-7.5-smbdirect
>
> I guess it's already fixed with that.
>
> Thanks!
> metze
>
> Am 21.10.26 um 23:16 schrieb zdi-disclosures@xxxxxxxxxxxxxx:
> > ZDI-CAN-33549: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability
> >
> > -- CVSS -----------------------------------------
> >
> > 9.0: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
> >
> > -- ABSTRACT -------------------------------------
> >
> > Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
> > Linux - Kernel KSMBD
> >
> > -- VULNERABILITY DETAILS ------------------------
> > * Version Tested:7.3-rc3
> > * Platform Tested:debian trixie
> >
> > ---
> >
> > ### Analysis
> >
> > integer underflow in smbdirect_connection_rdma_xmit()
> > The reproduce kernel built with CONFIG_SMB_SERVER_SMBDIRECT=y + CONFIG_RDMA_RXE=y
> > Here is the target requirement
> > 1) RDMA device
> > 2) writable share
> > 3) smb direct (ubuntu only)
> >
> > ~~~C++
> > int smbdirect_connection_rdma_xmit(struct smbdirect_socket *sc,
> >                    void *buf, size_t buf_len,
> >                    struct smbdirect_buffer_descriptor_v1 *desc,
> >                    size_t desc_len,
> >                    bool is_read)
> > {
> > ...
> >     for (i = 0; i < desc_len / sizeof(*desc); i++) {
> >         if (!buf_len)
> >             break;
> >
> >         desc_buf_len = le32_to_cpu(desc[i].length);
> >         if (!desc_buf_len)
> >             return -EINVAL;
> >
> >         if (desc_buf_len > buf_len) {
> >             desc_buf_len = buf_len;
> >             desc[i].length = cpu_to_le32(desc_buf_len);
> >             buf_len = 0;                                            // (1)
> >         }
> >
> >         credits_needed += smbdirect_connection_calc_rw_credits(sc,
> >                                        desc_buf,
> >                                        desc_buf_len);
> >         desc_buf += desc_buf_len;
> >         buf_len -= desc_buf_len;                                    // (2) integer underflow, and leads to heap overflow within rxe_mr_copy()
> >         desc_num++;
> >     }

As far as I can see the problem is solved in by patches,
but we should have a simple fix first.

I think removing ' buf_len = 0;' should be enough for a quick fix,
then 'buf_len -= desc_buf_len;' will result in buf_len == 0 and the next
iteration will break with if (!buf_len).

Namjae, do you agree? Can you create such a quick fix?

Thanks!
metze