Re: ZDI-CAN-33549: New Vulnerability Report

[Stefan Metzmacher <metze@samba.org>]

Am 23.10.26 um 12:36 schrieb Namjae Jeon:
> On Fri, Oct 23, 2026 at 6:04 PM Stefan Metzmacher <metze@samba.org> wrote:
>>
>> Am 22.10.26 um 00:16 schrieb Stefan Metzmacher via samba-technical:
>>> Hi HYEONTAE LEE,
>>>
>>> would you be able to test if this is reproducable on this branch:
>>> https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/for-7.5/smbdirect
>>> git clone -b for-7.5/smbdirect  https://git.samba.org/metze/linux/wip.git for-7.5-smbdirect
>>>
>>> I guess it's already fixed with that.
>>>
>>> Thanks!
>>> metze
>>>
>>> Am 21.10.26 um 23:16 schrieb zdi-disclosures@trendmicro.com:
>>>> ZDI-CAN-33549: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability
>>>>
>>>> -- CVSS -----------------------------------------
>>>>
>>>> 9.0: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
>>>>
>>>> -- ABSTRACT -------------------------------------
>>>>
>>>> Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
>>>> Linux - Kernel KSMBD
>>>>
>>>> -- VULNERABILITY DETAILS ------------------------
>>>> * Version Tested:7.3-rc3
>>>> * Platform Tested:debian trixie
>>>>
>>>> ---
>>>>
>>>> ### Analysis
>>>>
>>>> integer underflow in smbdirect_connection_rdma_xmit()
>>>> The reproduce kernel built with CONFIG_SMB_SERVER_SMBDIRECT=y + CONFIG_RDMA_RXE=y
>>>> Here is the target requirement
>>>> 1) RDMA device
>>>> 2) writable share
>>>> 3) smb direct (ubuntu only)
>>>>
>>>> ~~~C++
>>>> int smbdirect_connection_rdma_xmit(struct smbdirect_socket *sc,
>>>>                     void *buf, size_t buf_len,
>>>>                     struct smbdirect_buffer_descriptor_v1 *desc,
>>>>                     size_t desc_len,
>>>>                     bool is_read)
>>>> {
>>>> ...
>>>>      for (i = 0; i < desc_len / sizeof(*desc); i++) {
>>>>          if (!buf_len)
>>>>              break;
>>>>
>>>>          desc_buf_len = le32_to_cpu(desc[i].length);
>>>>          if (!desc_buf_len)
>>>>              return -EINVAL;
>>>>
>>>>          if (desc_buf_len > buf_len) {
>>>>              desc_buf_len = buf_len;
>>>>              desc[i].length = cpu_to_le32(desc_buf_len);
>>>>              buf_len = 0;                                            // (1)
>>>>          }
>>>>
>>>>          credits_needed += smbdirect_connection_calc_rw_credits(sc,
>>>>                                         desc_buf,
>>>>                                         desc_buf_len);
>>>>          desc_buf += desc_buf_len;
>>>>          buf_len -= desc_buf_len;                                    // (2) integer underflow, and leads to heap overflow within rxe_mr_copy()
>>>>          desc_num++;
>>>>      }
>>
>> As far as I can see the problem is solved in by patches,
>> but we should have a simple fix first.
>>
>> I think removing ' buf_len = 0;' should be enough for a quick fix,
>> then 'buf_len -= desc_buf_len;' will result in buf_len == 0 and the next
>> iteration will break with if (!buf_len).
>>
>> Namjae, do you agree? Can you create such a quick fix?
> Agreed, Please check the attached patch.
> Thanks for checking this issue!

Thanks, looks good.
metze