Re: ZDI-CAN-33549: New Vulnerability Report

[Stefan Metzmacher <metze@samba.org>]

Am 22.10.26 um 00:16 schrieb Stefan Metzmacher via samba-technical:
> Hi HYEONTAE LEE,
> 
> would you be able to test if this is reproducable on this branch:
> https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/for-7.5/smbdirect
> git clone -b for-7.5/smbdirect  https://git.samba.org/metze/linux/wip.git for-7.5-smbdirect
> 
> I guess it's already fixed with that.
> 
> Thanks!
> metze
> 
> Am 21.10.26 um 23:16 schrieb zdi-disclosures@trendmicro.com:
>> ZDI-CAN-33549: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability
>>
>> -- CVSS -----------------------------------------
>>
>> 9.0: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
>>
>> -- ABSTRACT -------------------------------------
>>
>> Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
>> Linux - Kernel KSMBD
>>
>> -- VULNERABILITY DETAILS ------------------------
>> * Version Tested:7.3-rc3
>> * Platform Tested:debian trixie
>>
>> ---
>>
>> ### Analysis
>>
>> integer underflow in smbdirect_connection_rdma_xmit()
>> The reproduce kernel built with CONFIG_SMB_SERVER_SMBDIRECT=y + CONFIG_RDMA_RXE=y
>> Here is the target requirement
>> 1) RDMA device
>> 2) writable share
>> 3) smb direct (ubuntu only)
>>
>> ~~~C++
>> int smbdirect_connection_rdma_xmit(struct smbdirect_socket *sc,
>>                    void *buf, size_t buf_len,
>>                    struct smbdirect_buffer_descriptor_v1 *desc,
>>                    size_t desc_len,
>>                    bool is_read)
>> {
>> ...
>>     for (i = 0; i < desc_len / sizeof(*desc); i++) {
>>         if (!buf_len)
>>             break;
>>
>>         desc_buf_len = le32_to_cpu(desc[i].length);
>>         if (!desc_buf_len)
>>             return -EINVAL;
>>
>>         if (desc_buf_len > buf_len) {
>>             desc_buf_len = buf_len;
>>             desc[i].length = cpu_to_le32(desc_buf_len);
>>             buf_len = 0;                                            // (1)
>>         }
>>
>>         credits_needed += smbdirect_connection_calc_rw_credits(sc,
>>                                        desc_buf,
>>                                        desc_buf_len);
>>         desc_buf += desc_buf_len;
>>         buf_len -= desc_buf_len;                                    // (2) integer underflow, and leads to heap overflow within rxe_mr_copy()
>>         desc_num++;
>>     }

As far as I can see the problem is solved in by patches,
but we should have a simple fix first.

I think removing ' buf_len = 0;' should be enough for a quick fix,
then 'buf_len -= desc_buf_len;' will result in buf_len == 0 and the next
iteration will break with if (!buf_len).

Namjae, do you agree? Can you create such a quick fix?

Thanks!
metze