Odebrany

CVE-2026-90170

opublikowano: 17.09.2026, 19:17

modyfikacja: 17.09.2026, 19:17

Ocena CVSS

n/a

Brak oceny

Oficjalne źródła

>_ Opis

Tłumaczenie automatyczne – może zawierać nieścisłości.

W jądrze Linuksa usunięto następującą lukę:

ksmbd: sprawdź długość odpowiedzi ipc przed wyłuskaniem jego pól

ipc_validate_msg() oblicza oczekiwany rozmiar wiadomości na podstawie długości odczytu
pola z bufora odpowiedzi dostarczonego przez demona ksmbd przestrzeni użytkownika
(ładunek_sz, session_key_len, ngroups, ...). Pola te są czytane wcześniej
sprawdza się, czy bufor jest wystarczająco duży, aby pomieścić strukturę, do której należy
do, więc krótka odpowiedź powoduje, że odczyt przekracza koniec alokacji.

handle_response() rozmiary wpisu->odpowiedzi wyłącznie na podstawie atrybutu netlink
długość (nla_len()) i chroni tylko wiodący uchwyt do odczytu, więc demon
może zainstalować odpowiedź tak małą jak obiekt kmalloc-8 pokazany poniżej. Kiedy
ipc_msg_send_request() następnie wywołuje ipc_validate_msg() w celu
KSMBD_EVENT_RPC_REQUEST, rzutowanie do struktury ksmbd_rpc_command odczytuje
resp->payload_sz w przesunięciu 8 8-bajtowej alokacji:

[ 3697.841381] ==================================================================
[3697.844099] BŁĄD: KASAN: płyta poza granicami w ipc_msg_send_request+0x763/0x800
[3697.846604] Odczyt rozmiaru 4 pod adresem ffff888105f95910 przez zadanie kworker/4:3/20682
[ 3697.849061]
[3697.849801] Procesor: 4 UID: 0 PID: 20682 Comm: kworker/4:3 Nieskażony 7.2.0-rc3-next-20260717-virtme #117 PREEMPT(leniwy)
[ 3697.850077] Nazwa sprzętu: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 01.04.2014
[ 3697.850303] Kolejka robocza: ksmbd-io handle_ksmbd_work
[ 3697.850592] Śledzenie połączeń:
[ 3697.850794] <ZADANIE>
[ 3697.850952] __dump_stack+0x21/0x60
[ 3697.851239] dump_stack_lvl+0xc2/0x100
[ 3697.851528] print_address_description+0x77/0x200
[3697.851816] ? ipc_msg_send_request+0x763/0x800
[ 3697.852024] print_raport+0x58/0x70
[ 3697.852316] kasan_report+0x117/0x150
[3697.852585] ? down_write+0x146/0x1f0
[3697.852809] ? ipc_msg_send_request+0x763/0x800
[ 3697.853082] ipc_msg_send_request+0x763/0x800
[3697.853385] ? __pfx_ipc_msg_send_request+0x10/0x10
[3697.853604] ? kasan_unpoison+0x48/0x70
[3697.853936] ? __pfx___up_read+0x10/0x10
[ 3697.854221] ksmbd_rpc_ioctl+0x380/0x520
[3697.854542] ? __pfx_ksmbd_rpc_ioctl+0x10/0x10
[3697.854757] ? kasan_unpoison+0x48/0x70
[3697.854962] ? copy_from_kernel_nofault+0x32c/0x4e0
[3697.855166] ? kasan_unpoison+0x48/0x70
[ 3697.855416] fsctl_pipe_transceive+0x139/0x7a0
[3697.855705] ? __pfx_copy_from_kernel_nofault+0x10/0x10
[3697.855937] ? __pfx_fsctl_pipe_transceive+0x10/0x10
[3697.856388] ? __sanitizer_cov_trace_switch+0x7b/0x140
[ 3697.856620] smb2_ioctl+0x1141/0x3420
[3697.856994] ? __pfx_smb2_ioctl+0x10/0x10
[3697.857182] ? get_smb2_cmd_val+0xe3/0x1c0
[ 3697.857655] handle_ksmbd_work+0x9ad/0x15e0
[3697.858034] ? __pfx_handle_ksmbd_work+0x10/0x10
[3697.858251] ? lock_release+0xf7/0x360
[3697.858466] ? proces_scheduled_works+0x954/0x1600
[3697.858698] ? proces_scheduled_works+0x954/0x1600
[ 3697.858905] proces_scheduled_works+0xc22/0x1600
[3697.859368] ? __pfx_process_scheduled_works+0x10/0x10
[3697.859637] ? __pfx_przypisanie_work+0x10/0x10
[3697.859896] ? lock_is_held_type+0x7b/0x110
[ 3697.860146] wątek_pracownika+0x975/0xee0
[3697.860524] ? __pfx_do_raw_spin_lock+0x10/0x10
[3697.860830] ? __kthread_parkme+0x21e/0x260
[ 3697.861105] kwątek+0x3a6/0x490
[3697.861423] ? __pfx_worker_thread+0x10/0x10
[3697.861643] ? __pfx_kthread+0x10/0x10
[ 3697.861878] ret_from_fork+0x55a/0xa20
[3697.862194] ? __pfx_ret_from_fork+0x10/0x10
[3697.862480] ? __pfx_kthread+0x10/0x10
[ 3697.862714] ret_from_fork_asm+0x1a/0x30
[3697.862965]</TASK>
[ 3697.863039]
[3697.938882] Przydzielone przez zadanie 20761:
[ 3697.940257] kasan_save_track+0x3e/0x80
[ 3697.941782] __kasan_kmalloc+0x72/0x90
[ 3697.943228] __kvmalloc_node_noprof+0x3e9/0x6a0
[ 3697.944948] handle_generic_event+0x59b/0x750
[ 3697.946592] genl_family_rcv_msg_doit+0x3d6/0x560
[ 3697.946977] genl_rcv_msg+0x67c/0x900
[ 3697.947224] netlink_rcv_skb+0x286/0x580
[ 3697.947488] genl_rcv+0x2d/0x80
[ 3
---obcięty---

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate ipc response length before dereferencing its fields

ipc_validate_msg() computes the expected message size by reading length
fields out of the response buffer supplied by the userspace ksmbd daemon
(payload_sz, session_key_len, ngroups, ...). Those fields are read before
the buffer is verified to be large enough to contain the struct they belong
to, so a short response makes the read land past the end of the allocation.

handle_response() sizes entry->response purely from the netlink attribute
length (nla_len()) and only guards the leading handle read, so the daemon
can install a response as small as the kmalloc-8 object seen below. When
ipc_msg_send_request() then calls ipc_validate_msg() for a
KSMBD_EVENT_RPC_REQUEST, the cast to struct ksmbd_rpc_command reads
resp->payload_sz at offset 8 of an 8-byte allocation:

[ 3697.841381] ==================================================================
[ 3697.844099] BUG: KASAN: slab-out-of-bounds in ipc_msg_send_request+0x763/0x800
[ 3697.846604] Read of size 4 at addr ffff888105f95910 by task kworker/4:3/20682
[ 3697.849061]
[ 3697.849801] CPU: 4 UID: 0 PID: 20682 Comm: kworker/4:3 Not tainted 7.2.0-rc3-next-20260717-virtme #117 PREEMPT(lazy)
[ 3697.850077] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 3697.850303] Workqueue: ksmbd-io handle_ksmbd_work
[ 3697.850592] Call Trace:
[ 3697.850794] <TASK>
[ 3697.850952] __dump_stack+0x21/0x60
[ 3697.851239] dump_stack_lvl+0xc2/0x100
[ 3697.851528] print_address_description+0x77/0x200
[ 3697.851816] ? ipc_msg_send_request+0x763/0x800
[ 3697.852024] print_report+0x58/0x70
[ 3697.852316] kasan_report+0x117/0x150
[ 3697.852585] ? down_write+0x146/0x1f0
[ 3697.852809] ? ipc_msg_send_request+0x763/0x800
[ 3697.853082] ipc_msg_send_request+0x763/0x800
[ 3697.853385] ? __pfx_ipc_msg_send_request+0x10/0x10
[ 3697.853604] ? kasan_unpoison+0x48/0x70
[ 3697.853936] ? __pfx___up_read+0x10/0x10
[ 3697.854221] ksmbd_rpc_ioctl+0x380/0x520
[ 3697.854542] ? __pfx_ksmbd_rpc_ioctl+0x10/0x10
[ 3697.854757] ? kasan_unpoison+0x48/0x70
[ 3697.854962] ? copy_from_kernel_nofault+0x32c/0x4e0
[ 3697.855166] ? kasan_unpoison+0x48/0x70
[ 3697.855416] fsctl_pipe_transceive+0x139/0x7a0
[ 3697.855705] ? __pfx_copy_from_kernel_nofault+0x10/0x10
[ 3697.855937] ? __pfx_fsctl_pipe_transceive+0x10/0x10
[ 3697.856388] ? __sanitizer_cov_trace_switch+0x7b/0x140
[ 3697.856620] smb2_ioctl+0x1141/0x3420
[ 3697.856994] ? __pfx_smb2_ioctl+0x10/0x10
[ 3697.857182] ? get_smb2_cmd_val+0xe3/0x1c0
[ 3697.857655] handle_ksmbd_work+0x9ad/0x15e0
[ 3697.858034] ? __pfx_handle_ksmbd_work+0x10/0x10
[ 3697.858251] ? lock_release+0xf7/0x360
[ 3697.858466] ? process_scheduled_works+0x954/0x1600
[ 3697.858698] ? process_scheduled_works+0x954/0x1600
[ 3697.858905] process_scheduled_works+0xc22/0x1600
[ 3697.859368] ? __pfx_process_scheduled_works+0x10/0x10
[ 3697.859637] ? __pfx_assign_work+0x10/0x10
[ 3697.859896] ? lock_is_held_type+0x7b/0x110
[ 3697.860146] worker_thread+0x975/0xee0
[ 3697.860524] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 3697.860830] ? __kthread_parkme+0x21e/0x260
[ 3697.861105] kthread+0x3a6/0x490
[ 3697.861423] ? __pfx_worker_thread+0x10/0x10
[ 3697.861643] ? __pfx_kthread+0x10/0x10
[ 3697.861878] ret_from_fork+0x55a/0xa20
[ 3697.862194] ? __pfx_ret_from_fork+0x10/0x10
[ 3697.862480] ? __pfx_kthread+0x10/0x10
[ 3697.862714] ret_from_fork_asm+0x1a/0x30
[ 3697.862965] </TASK>
[ 3697.863039]
[ 3697.938882] Allocated by task 20761:
[ 3697.940257] kasan_save_track+0x3e/0x80
[ 3697.941782] __kasan_kmalloc+0x72/0x90
[ 3697.943228] __kvmalloc_node_noprof+0x3e9/0x6a0
[ 3697.944948] handle_generic_event+0x59b/0x750
[ 3697.946592] genl_family_rcv_msg_doit+0x3d6/0x560
[ 3697.946977] genl_rcv_msg+0x67c/0x900
[ 3697.947224] netlink_rcv_skb+0x286/0x580
[ 3697.947488] genl_rcv+0x2d/0x80
[ 3
---truncated---

>_ Referencje

Dane podatności pochodzą z oficjalnych źródeł (CVE® List / NVD). Opisy po polsku są tłumaczone automatycznie i mogą zawierać nieścisłości – na stronie rekordu można wyświetlić wersję angielską.

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.

NVD Terms of Use / CVE® Terms of Use / nvd.nist.gov / cve.org

<< baza_cve