In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prevent out-of-bounds reads in share config responses
Validate IPC share configuration payload sizes before consuming
variable-length fields. Bound veto list parsing and account for
the separator byte when deriving the path length.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS Score: 7.1
AV:L - Malformed payload_sz/veto_list_sz and unterminated veto/path bytes are consumed from a ksmbd generic-netlink SHARE_CONFIG_RESPONSE (handle_generic_event → ipc_validate_msg → share_config_request), not from SMB PDUs. A remote TREE_CONNECT only creates the pending IPC request; the attacker must be local to inject or control that response.
AC:L - The attacker fully controls the crafted netlink length fields and can set payload_sz to 0 or omit NULs so the old checks pass. Pending handles come from a small IDA and can be brute-forced against a TREE_CONNECT the attacker also triggers; no victim timing or rare config is required.
PR:L - handle_generic_event requires CAP_NET_ADMIN only when CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN is set; SMBD_GENL is netns-aware, has no GENL_ADMIN_PERM, and does not bind responses to ksmbd_tools_pid. That capability is Low, and builds that disable the check allow any local user to send the message.
UI:N - The attacker sends the malformed SHARE_CONFIG_RESPONSE and can issue the matching SMB2 TREE_CONNECT themselves; no separate victim or administrator action is required once ksmbd is running.
S:U - The out-of-bounds reads and any resulting oops remain inside the ksmbd/kernel security authority on the host. This is not a VM escape, IOMMU/DMA bypass, or other cross-boundary impact.
C:H - With payload_sz==0 the kernel kstrndup()s up to PATH_MAX bytes past the IPC object, and parse_veto_list() uses unbounded strlen()/kstrdup() when the veto buffer lacks a NUL within veto_list_sz. Those are large kernel-heap over-reads, not a few bounded bytes.
I:N - The defects are out-of-bounds reads (strlen, kstrndup, kstrdup) into newly allocated strings; there is no out-of-bounds write or control-flow hijack primitive. A local IPC sender can already supply a well-formed share path without this bug.
A:H - Walking strlen() or kstrndup(..., PATH_MAX) off the end of the IPC slab into unmapped memory oopses the ksmbd worker. The attacker can repeat the crafted response against further TREE_CONNECT-triggered requests and crash the kernel at will.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:L - Malformed payload_sz/veto_list_sz and unterminated veto/path bytes are consumed from a ksmbd generic-netlink SHARE_CONFIG_RESPONSE (handle_generic_event → ipc_validate_msg → share_config_request), not from SMB PDUs. A remote TREE_CONNECT only creates the pending IPC request; the attacker must be local to inject or control that response.
AC:L - The attacker fully controls the crafted netlink length fields and can set payload_sz to 0 or omit NULs so the old checks pass. Pending handles come from a small IDA and can be brute-forced against a TREE_CONNECT the attacker also triggers; no victim timing or rare config is required.
PR:L - handle_generic_event requires CAP_NET_ADMIN only when CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN is set; SMBD_GENL is netns-aware, has no GENL_ADMIN_PERM, and does not bind responses to ksmbd_tools_pid. That capability is Low, and builds that disable the check allow any local user to send the message.
UI:N - The attacker sends the malformed SHARE_CONFIG_RESPONSE and can issue the matching SMB2 TREE_CONNECT themselves; no separate victim or administrator action is required once ksmbd is running.
S:U - The out-of-bounds reads and any resulting oops remain inside the ksmbd/kernel security authority on the host. This is not a VM escape, IOMMU/DMA bypass, or other cross-boundary impact.
C:H - With payload_sz==0 the kernel kstrndup()s up to PATH_MAX bytes past the IPC object, and parse_veto_list() uses unbounded strlen()/kstrdup() when the veto buffer lacks a NUL within veto_list_sz. Those are large kernel-heap over-reads, not a few bounded bytes.
I:N - The defects are out-of-bounds reads (strlen, kstrndup, kstrdup) into newly allocated strings; there is no out-of-bounds write or control-flow hijack primitive. A local IPC sender can already supply a well-formed share path without this bug.
A:H - Walking strlen() or kstrndup(..., PATH_MAX) off the end of the IPC slab into unmapped memory oopses the ksmbd worker. The attacker can repeat the crafted response against further TREE_CONNECT-triggered requests and crash the kernel at will.
CVSS 3.1