linux-kernel - cifs: out-of-bound write in build_ntlmssp_auth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <56B21331.1010402@redhat.com>
Date:	Wed, 3 Feb 2016 15:48:17 +0100
From:	Jerome Marchand <jmarchan@...hat.com>
To:	Steve French <sfrench@...ba.org>
Cc:	linux-cifs@...r.kernel.org,
	"'linux-kernel'" <linux-kernel@...r.kernel.org>
Subject: cifs: out-of-bound write in build_ntlmssp_auth_blob()

Hi,

While running some test, KASan detected several out-of-bound write
accesses to the ntlmssp blob in build_ntlmssp_auth_blob(). In this case,
the ntlmssp blob was allocated in sess_auth_rawntlmssp_authenticate().
Its size is an "empirical" 5*sizeof(struct _AUTHENTICATE_MESSAGE) (320B
on x86_64). I don't know where this value comes from or if it was ever
appropriate, but it is currently insufficient: the user and domain name
in UTF16 could take 1kB by themselves. I'm not sure what's the proper
way to fix this. Naively I'd say to allocate the blob dynamically in
build_ntlmssp_auth_blob().
While I haven't run into the issue, the size of ntlmssp_blob in
SMB2_sess_setup is too small too (sizeof(struct _NEGOTIATE_MESSAGE) + 500).

Regards,
Jerome Marchand

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)