[PATCH] smb: server: Clear sensitive stack and heap data in auth.c

[PATCH] smb: server: Clear sensitive stack and heap data in auth.c

[Thomas Huth]

From: Thomas Huth <thuth@redhat.com>

Sensitive data like keys that are stored in stack-local arrays could be
leaked via the stack to the calling functions, or via the heap when using
only normal kfree() functions. There is no known vulnaribility for this in
this code right now, but it's good security style to explicitly zeroize this
sensitive material as soon as possible to avoid that it could be exploited
together with other bugs later.

In calc_ntlmv2_hash(), the struct hmac_md5_ctx is normally cleared during
hmac_md5_final() already, but in case of errors, this function is skipped
and ctx is never zeroized, so add a memzero_explicit(&ctx, sizeof(ctx))
there to fix the problem.

In ksmbd_krb5_authenticate(), the ksmbd_spnego_authen_response contains
the session key in the payload. It's currently freed with plain kvfree().
Let's better use kvfree_sensitive() instead.

In generate_key(), the prfhash[] array is used to calculate the key,
but it's never cleared, so it leaks on the stack. Thus clear this with
a memzero_explicit(), too.

In ksmbd_crypt_message(), the sign[] and key[] arrays are leaked via
the stack, too. Make sure to clear them via memzero_explicit() at the
end.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 fs/smb/server/auth.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 4e7b6f0e6b8cd..acdac40bee813 100644
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -122,6 +122,8 @@ static int calc_ntlmv2_hash(struct ksmbd_conn *conn, struct ksmbd_session *sess,
 out:
 	kfree(uniname);
 	kfree(domain);
+	if (ret)	/* Done by hmac_md5_final() already if ret == 0 */
+		memzero_explicit(&ctx, sizeof(ctx));
 	return ret;
 }
 
@@ -464,7 +466,7 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
 	*out_len = resp->spnego_blob_len;
 	retval = 0;
 out:
-	kvfree(resp);
+	kvfree_sensitive(resp);
 	return retval;
 }
 #else
@@ -556,6 +558,7 @@ static void generate_key(struct ksmbd_conn *conn, const char *sess_key,
 
 	hmac_sha256_final(&ctx, prfhash);
 	memcpy(key, prfhash, key_size);
+	memzero_explicit(prfhash, sizeof(prfhash));
 }
 
 static int generate_smb3signingkey(struct ksmbd_session *sess,
@@ -848,7 +851,8 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,
 		ctx = ksmbd_crypto_ctx_find_ccm();
 	if (!ctx) {
 		pr_err("crypto alloc failed\n");
-		return -ENOMEM;
+		rc = -ENOMEM;
+		goto zeroize_key;
 	}
 
 	if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
@@ -928,5 +932,8 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,
 	aead_request_free(req);
 free_ctx:
 	ksmbd_release_crypto_ctx(ctx);
+zeroize_key:
+	memzero_explicit(key, sizeof(key));
+	memzero_explicit(sign, sizeof(sign));
 	return rc;
 }
-- 
2.55.0

Re: [PATCH] smb: server: Clear sensitive stack and heap data in auth.c

[Thomas Huth]

On 07/08/2026 19.10, Thomas Huth wrote:
> From: Thomas Huth <thuth@redhat.com>
> 
> Sensitive data like keys that are stored in stack-local arrays could be
> leaked via the stack to the calling functions, or via the heap when using
> only normal kfree() functions. There is no known vulnaribility for this in
> this code right now, but it's good security style to explicitly zeroize this
> sensitive material as soon as possible to avoid that it could be exploited
> together with other bugs later.
> 
> In calc_ntlmv2_hash(), the struct hmac_md5_ctx is normally cleared during
> hmac_md5_final() already, but in case of errors, this function is skipped
> and ctx is never zeroized, so add a memzero_explicit(&ctx, sizeof(ctx))
> there to fix the problem.
> 
> In ksmbd_krb5_authenticate(), the ksmbd_spnego_authen_response contains
> the session key in the payload. It's currently freed with plain kvfree().
> Let's better use kvfree_sensitive() instead.
> 
> In generate_key(), the prfhash[] array is used to calculate the key,
> but it's never cleared, so it leaks on the stack. Thus clear this with
> a memzero_explicit(), too.
> 
> In ksmbd_crypt_message(), the sign[] and key[] arrays are leaked via
> the stack, too. Make sure to clear them via memzero_explicit() at the
> end.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>   fs/smb/server/auth.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
> index 4e7b6f0e6b8cd..acdac40bee813 100644
> --- a/fs/smb/server/auth.c
> +++ b/fs/smb/server/auth.c
> @@ -122,6 +122,8 @@ static int calc_ntlmv2_hash(struct ksmbd_conn *conn, struct ksmbd_session *sess,
>   out:
>   	kfree(uniname);
>   	kfree(domain);
> +	if (ret)	/* Done by hmac_md5_final() already if ret == 0 */
> +		memzero_explicit(&ctx, sizeof(ctx));
>   	return ret;
>   }
>   
> @@ -464,7 +466,7 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
>   	*out_len = resp->spnego_blob_len;
>   	retval = 0;
>   out:
> -	kvfree(resp);
> +	kvfree_sensitive(resp);
D'oh, self-nack, I really should not send patches in a hurry on Friday 
afternoon, sorry!

I will send a fixed version next week.

  Thomas

Re: [PATCH] smb: server: Clear sensitive stack and heap data in auth.c

[ChenXiaoSong]

Thanks for your patch. This patch cannot apply to the 
`ksmbd-for-next-next` branch. Please rebase the next version on 
`ksmbd-for-next-next` branch:
https://github.com/smfrench/smb3-kernel/commits/ksmbd-for-next-next/

在 2026/8/8 4:16, Thomas Huth 写道:
> D'oh, self-nack, I really should not send patches in a hurry on Friday 
> afternoon, sorry!
> 
> I will send a fixed version next week.

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en