From: Paulo Alcantara <pc@manguebit.org>
To: Abdifatah Suruur <suruurism@gmail.com>, linux-cifs@vger.kernel.org
Cc: Namjae Jeon <linkinjeon@kernel.org>,
Ronnie Sahlberg <ronniesahlberg@gmail.com>,
Shyam Prasad N <sprasad@microsoft.com>,
Tom Talpey <tom@talpey.com>, Bharath SM <bharathsm@microsoft.com>,
samba-technical@lists.samba.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] smb: client: reject short SESSION_SETUP responses
Date: Thu, 22 Oct 2026 20:39:12 -0300 [thread overview]
Message-ID: <7db0730ee15b4a6d441d5177a9dcf3d0@manguebit.org> (raw)
In-Reply-To: <20261022035314.17801-1-suruurism@gmail.com>
Abdifatah Suruur <suruurism@gmail.com> writes:
> smb2_check_message() accepts frames shorter than struct smb2_pdu when
> the SMB2 status is non-zero, before the minimum-PDU check added by
> b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP
> response is therefore accepted even though it cannot contain the
> SecurityBufferOffset and SecurityBufferLength fields.
>
> The parser then reads those fields from stale bytes left in the reused
> receive buffer by an earlier frame. With a long stale
> SecurityBufferLength, decode_ntlmssp_challenge() copies up to about
> 64 KB from beyond the receive object and sends the data back to the
> server in the NTLMv2 AUTHENTICATE target info.
>
> Reject short MPR SESSION_SETUP responses before the short-error path,
> and validate SecurityBufferOffset + SecurityBufferLength against the
> received response length before decoding the challenge.
> ...
Applied.
prev parent reply other threads:[~2026-10-22 23:39 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-22 3:53 Abdifatah Suruur
2026-10-22 23:39 ` Paulo Alcantara [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7db0730ee15b4a6d441d5177a9dcf3d0@manguebit.org \
--to=pc@manguebit.org \
--cc=bharathsm@microsoft.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ronniesahlberg@gmail.com \
--cc=samba-technical@lists.samba.org \
--cc=sprasad@microsoft.com \
--cc=suruurism@gmail.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®