Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken [2] OCTET STRING element, ksmbd_neg_token_alloc() allocates conn->mechToken immediately via kmemdup_nul(). If a later element in the same blob is malformed, then the decoder will return nonzero after the allocation is already live. This could happen if mechListMIC [3] overrunse the enclosing SEQUENCE. decode_negotiation_token() then sets conn->use_spnego = false because both the negTokenInit and negTokenTarg grammars failed. The cleanup at the bottom of smb2_sess_setup() is gated on use_spnego: if (conn->use_spnego && conn->mechToken) { kfree(conn->mechToken); conn->mechToken = NULL; } so the kfree is skipped, causing the mechToken to never be freed. This codepath is reachable pre-authentication, so untrusted clients can cause slow memory leaks on a server without even being properly authenticated. Fix this up by not checking check for use_spnego, as it's not required, so the memory will always be properly freed. At the same time, always free the memory in ksmbd_conn_free() incase some other failure path forgot to free it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fad4161b5cd01a24202234976ebbb133f7adc0b5 to < ae9cdb29efed20ffdee9ff3b0bb72fb369c353daaffectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < bd4a7fb04f06f419b0e93d8b52fe32067eb312d1affectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < 745a535461bbb90a56d9357573c9f97a5c12abe1affectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < dd577cb55588ec3fbc66af3621280306601c4192affectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < dd53414e301beb915fe672dc4c4a51bafb917604affectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < 269c800a7a7e363459291885b35f7bc72e231ed6affectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < 6c8c44e6553b9f072f62d9875e567766eb293162affectedfad4161b5cd01a24202234976ebbb133f7adc0b5 to < ad0057fb91218914d6c98268718ceb9d59b388e1affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.83 to ≤ 6.12.*unaffected6.18.24 to ≤ 6.18.*unaffected6.19.14 to ≤ 6.19.*unaffected7.0.1 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ae9cdb29efed20ffdee9ff3b0bb72fb369c353da ↗
- https://git.kernel.org/stable/c/bd4a7fb04f06f419b0e93d8b52fe32067eb312d1 ↗
- https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1 ↗
- https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192 ↗
- https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604 ↗
- https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6 ↗
- https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162 ↗
- https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1 ↗