linux-kernel - Re: LINUX kernel 2.6.23: bug in CIFSSMBSetEA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 30 Dec 2007 18:24:59 -0600
From:	"Steve French" <smfrench@...il.com>
To:	LKML <linux-kernel@...r.kernel.org>
Subject: Re: LINUX kernel 2.6.23: bug in CIFSSMBSetEA

> In fs/cifs/cifssmb.c, in CIFSSMBSetEA (...) function wrong counting of
> var exists.

>
> EXISTING CODE:
> pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len + 1;
>
> MUST BE:
> pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len;
>

> REASON:
> "sizeof(*parm_data)" counts 1 byte from "char name[1];"
>
> So, for example in Samba server (sources/smbd/trans2.c), we can see

> wrong processing of EA, cause data sent to server is bigger on 1 byte
> then it must be.
>
> See Extra info for details
>
> --------------------------------------------- Extra info

>
> struct fealist *parm_data;
>
> 1707 struct fea {
> 1708 unsigned char EA_flags;
> 1709 __u8 name_len;
> 1710 __u16 value_len;
> 1711 char name
[1];
> 1712 /* optionally followed by value */
> 1713 };
> 1714 /* flags for _FEA.fEA */
> 1715 #define FEA_NEEDEA 0x80 /* need EA bit */

> 1716
> 1717 struct fealist {
> 1718 __u32 list_len;
> 1719 struct fea list[1];
> 1720 };



Yes - you are correct (note that Windows is less strict with the extra
pad byte than current Samba, and I don't remember seeing this with
older Samba server versions perhaps the length check ).


I have checked in a fix to the cifs development tree. Thanks.



-- 
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/