In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:
data_area_of_tgt = (char )&pSMBt->hdr.Protocol +
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
data_area_of_src = (char )&pSMBs->hdr.Protocol +
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
data_area_of_tgt += total_in_tgt;
...
memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.
The "validate target area" comment present since the function was
first written in 2005 was a placeholder that was never implemented.
Add lower- and upper-bound checks for both data pointers before the
memcpy, and before any target header fields are modified.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - coalesce_t2() runs in cifs_demultiplex_thread on SMB1 TRANS2 responses received over TCP/445; a malicious or compromised SMB1 server (or MITM on an unsigned session) delivers the crafted DataOffset/DataCount fields entirely over the network.
AC:L - The server fully controls DataOffset, DataCount, and TotalDataCount in both primary and secondary TRANS2 PDUs and can force a large first fragment so mid->resp_buf is set; the unbounded memcpy is deterministic with no race or condition outside the attacker’s control.
PR:N - The attacker is the remote SMB peer and needs no account or privileges on the victim; coalesce_t2() runs in the demux thread before validate_t2() or any local capability check, and session credentials belong to the client mount, not the attacking server.
UI:N - Once an SMB1 CIFS mount exists (fstab, autofs, embedded/industrial NAS; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults on), reconnect and ordinary lookup/readdir/getattr plus cifs_qfs_tcon QUERY_FS_INFO issue TRANS2 automatically, so the server can trigger coalescing with no further user action.
S:U - The out-of-bounds heap read/write corrupts the client kernel’s own cifs_request slab within the same host security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.
C:H - An unvalidated source DataOffset lets memcpy read far past the secondary response (DataOffset is a 16-bit value up to 65535 versus a ~16KB cifs_request object), disclosing adjacent kernel heap; the same memory-corruption primitive can be leveraged for further disclosure.
I:H - An unvalidated target DataOffset lets memcpy write attacker-controlled bytes past the primary buffer (or backward into the SMB header); the BCC-size guard does not constrain where the copy starts, yielding an out-of-bounds write exploitable for control-flow hijacking.
A:H - Reading or writing tens of kilobytes past the cifs_request allocation can fault on unmapped pages and oops or panic the demux thread, and a malicious server can retrigger it on every multi-part TRANS2.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - coalesce_t2() runs in cifs_demultiplex_thread on SMB1 TRANS2 responses received over TCP/445; a malicious or compromised SMB1 server (or MITM on an unsigned session) delivers the crafted DataOffset/DataCount fields entirely over the network.
AC:L - The server fully controls DataOffset, DataCount, and TotalDataCount in both primary and secondary TRANS2 PDUs and can force a large first fragment so mid->resp_buf is set; the unbounded memcpy is deterministic with no race or condition outside the attacker’s control.
PR:N - The attacker is the remote SMB peer and needs no account or privileges on the victim; coalesce_t2() runs in the demux thread before validate_t2() or any local capability check, and session credentials belong to the client mount, not the attacking server.
UI:N - Once an SMB1 CIFS mount exists (fstab, autofs, embedded/industrial NAS; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults on), reconnect and ordinary lookup/readdir/getattr plus cifs_qfs_tcon QUERY_FS_INFO issue TRANS2 automatically, so the server can trigger coalescing with no further user action.
S:U - The out-of-bounds heap read/write corrupts the client kernel’s own cifs_request slab within the same host security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.
C:H - An unvalidated source DataOffset lets memcpy read far past the secondary response (DataOffset is a 16-bit value up to 65535 versus a ~16KB cifs_request object), disclosing adjacent kernel heap; the same memory-corruption primitive can be leveraged for further disclosure.
I:H - An unvalidated target DataOffset lets memcpy write attacker-controlled bytes past the primary buffer (or backward into the SMB header); the BCC-size guard does not constrain where the copy starts, yielding an out-of-bounds write exploitable for control-flow hijacking.
A:H - Reading or writing tens of kilobytes past the cifs_request allocation can fault on unmapped pages and oops or panic the demux thread, and a malicious server can retrigger it on every multi-part TRANS2.
CVSS 3.1