Re: [PATCH v3 0/2] smb: client: fix out-of-bounds reads in CIFSSMBRead()

[Frank Sorenson <sorenson@redhat.com>]

Hi Diego,

On 9/2/26 5:42 AM, Diego Oliva wrote:
> CIFSSMBRead() parses the server's READ_RSP without validating either
> the length of the response or the DataOffset it carries. A malicious
> or compromised SMB1 server can exploit either to read past the end of
> the receive buffer, leaking adjacent kernel heap into the caller's
> read buffer or oopsing on unmapped memory. SMB1 is not negotiated by
> default; reaching this code requires an explicit vers=1.0 mount.
>
> Patch 1 rejects responses too short to contain a whole READ_RSP, so
> the header fields can be dereferenced safely. Patch 2 ejects a
> DataOffset/DataLength pair that falls outside the received response.

Your patch 2 checks that data_offset + data_length fit:

+		} else if ((size_t)data_offset + data_length > rsp_iov.iov_len) {

but I think you may also need a lower-bound check to make sure
data_offset is at least sizeof(READ_RSP):

+               } else if (data_offset < sizeof(READ_RSP)) {

otherwise, the data would overlap the response header itself.

Frank

-- 
Frank Sorenson
sorenson@redhat.com
Principal Software Maintenance Engineer, filesystems
Red Hat