projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 17d5b13) | patch
ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
authorNamjae Jeon <linkinjeon@kernel.org>
Fri, 25 Aug 2023 14:40:31 +0000 (23:40 +0900)
committerSteve French <stfrench@microsoft.com>
Tue, 29 Aug 2023 17:30:20 +0000 (12:30 -0500)
commit4b081ce0d830b684fdf967abc3696d1261387254
treeb913be8fb314c5713d29bfb98bdf75ebc6a6d4a4tree | snapshot
parent17d5b135bb720832364e8f55f6a887a3c7ec8fdbcommit | diff
ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

If authblob->SessionKey.Length is bigger than session key
size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes.
cifs_arc4_crypt copy to session key array from SessionKey from client.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21940
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/auth.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git