1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user.

1
int smb2_sess_setup(struct ksmbd_work *work)
2
{
3
  ...
4
      if (!ksmbd_conn_need_reconnect(conn)) {
5
        ksmbd_conn_set_good(conn);
6
        sess->state = SMB2_SESSION_VALID;
7
      }
8
...
9
        if (!ksmbd_conn_need_reconnect(conn)) {
10
          ksmbd_conn_set_good(conn);
11
          sess->state = SMB2_SESSION_VALID;
12
        }
13
        ...
14
}

1
#ifdef CONFIG_SMB_SERVER_KERBEROS5
2
static int krb5_authenticate(struct ksmbd_work *work,
3
           struct smb2_sess_setup_req *req,
4
           struct smb2_sess_setup_rsp *rsp)
5
{
6
  struct ksmbd_conn *conn = work->conn;
7
  struct ksmbd_session *sess = work->sess;
8
  char *in_blob, *out_blob;
9
  struct channel *chann = NULL;
10
  u64 prev_sess_id;
11
  int in_len, out_len;
12
  int retval;
13

14
    ...
15
  if (sess->state == SMB2_SESSION_VALID)
16
    ksmbd_free_user(sess->user);
17

18
  retval = ksmbd_krb5_authenticate(sess, in_blob, in_len,
19
           out_blob, &out_len);
20
  if (retval) {
21
    ksmbd_debug(SMB, "krb5 authentication failed\n");
22
    return -EINVAL;
23
  }
24

25
    ...
26
  return 0;
27
}

1
#ifdef CONFIG_SMB_SERVER_KERBEROS5
2
int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
3
          int in_len, char *out_blob, int *out_len)
4
{
5
  struct ksmbd_spnego_authen_response *resp;
6
  struct ksmbd_login_response_ext *resp_ext = NULL;
7
  struct ksmbd_user *user = NULL;
8
  int retval;
9

10
  resp = ksmbd_ipc_spnego_authen_request(in_blob, in_len);
11
  if (!resp) {
12
    ksmbd_debug(AUTH, "SPNEGO_AUTHEN_REQUEST failure\n");
13
    return -EINVAL;
14
  }
15

16
  if (!(resp->login_response.status & KSMBD_USER_FLAG_OK)) {
17
    ksmbd_debug(AUTH, "krb5 authentication failure\n");
18
    retval = -EPERM;
19
    goto out;
20
  }
21

22
  if (*out_len <= resp->spnego_blob_len) {
23
    ksmbd_debug(AUTH, "buf len %d, but blob len %d\n",
24
          *out_len, resp->spnego_blob_len);
25
    retval = -EINVAL;
26
    goto out;
27
  }
28

29
  if (resp->session_key_len > sizeof(sess->sess_key)) {
30
    ksmbd_debug(AUTH, "session key is too long\n");
31
    retval = -EINVAL;
32
    goto out;
33
  }
34

35
  if (resp->login_response.status & KSMBD_USER_FLAG_EXTENSION)
36
    resp_ext = ksmbd_ipc_login_request_ext(resp->login_response.account);
37

38
  user = ksmbd_alloc_user(&resp->login_response, resp_ext);
39
  if (!user) {
40
    ksmbd_debug(AUTH, "login failure\n");
41
    retval = -ENOMEM;
42
    goto out;
43
  }
44
  sess->user = user;
45

46
  memcpy(sess->sess_key, resp->payload, resp->session_key_len);
47
  memcpy(out_blob, resp->payload + resp->session_key_len,
48
         resp->spnego_blob_len);
49
  *out_len = resp->spnego_blob_len;
50
  retval = 0;
51
out:
52
  kvfree(resp);
53
  return retval;
54
}