Описание
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. When handling compounded SMB requests during Kerberos authentication, the server incorrectly calculates available buffer space, leading to a heap-based out-of-bounds write. A remote attacker could exploit this vulnerability by sending specially crafted requests, potentially allowing arbitrary code execution or causing a system crash that results in a Denial of Service (DoS).
Отчет
Critical severity is assigned because unauthenticated remote attackers could achieve arbitrary code execution via kernel heap corruption over the network. However, Red Hat Enterprise Linux does not enable or ship the in-kernel SMB server (ksmbd), relying instead on user-space Samba implementations. Because the vulnerable module is not compiled into supported Red Hat kernels, standard product deployments are not affected.
Меры по смягчению последствий
--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce physical buffer boundaries during compounded SMB2 session setup in ksmbd by subtracting prior response offsets from response buffer headroom: upgrade to the fixed release, which subtract work->next_smb2_rsp_hdr_off when computing out_len to accurately reflect physical remaining buffer space in response_buf, closing all 2 injection vectors (compounded SMB2 request chain with non-first SMB2_SESSION_SETUP, Kerberos AP-REP token payload). Until patched, this is only a concern on Linux systems running the in-kernel ksmbd SMB server with Kerberos authentication enabled — systems using user-space Samba implementations or Linux kernels without the ksmbd module enabled are unaffected — so restrict network access to SMB port 445 via firewall rules, disable Kerberos authentication in ksmbd, or unload the ksmbd kernel module and use user-space Samba. As a compensating measure, enable KASAN or HWASan runtime memory error detection to detect out-of-bounds heap writes via redzone and shadow memory instrumentation, enable Control Flow Integrity and Shadow Call Stack to validate kernel indirect function call targets and disrupt ROP or JOP execution, enforce non-executable permissions on kernel heap buffers via the NX or XD bit to prevent execution of injected shellcode payloads, enable Kernel Address Space Layout Randomization to hinder reliable control-flow redirection following heap corruption, enable Supervisor Mode Execution Prevention to prevent the kernel from executing attacker-controlled userspace pages, and enable Supervisor Mode Access Prevention to block the kernel from accessing attacker-controlled userspace memory during payload staging. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds write defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
In the Linux kernel, the following vulnerability has been resolved: k ...
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
EPSS
9.8 Critical
CVSS3