In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix heap overflow in DACL owner/group rewrite
When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a
buffer sized according to the on-disk DACL length reported by
dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each
ACE with a new owner/group SID obtained from the cifs.idmap upcall.
Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,
making each ACE up to 76 bytes (sizeof(struct smb_ace)).
If the original DACL contains short SIDs (e.g., 1 sub-authority) while
the replacement SIDs are long, the rewritten ACEs overflow the
allocation.
Fix this by always budgeting for worst-case SID expansion: allocate
sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which
covers the smb_acl header and room for every ACE at maximum SID size.
This replaces the previous split logic that used dacl_ptr->size for
cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid
mounts: both paths can trigger the same rewrite and need the same
headroom.
KASAN reports this as:
BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]
Write of size 4 at addr ffff8881a5e25374 by task chown/5298
...
The buggy address is located 0 bytes to the right of
allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 8.8
AV:N - chown/chgrp reaches id_mode_to_cifs_acl via cifs_setattr_nounix, which fetches the NTSD through get_smb2_acl → SMB2_query_acl (SMB2 QUERY_INFO, InfoType=SMB2_O_INFO_SECURITY). The DACL that undersizes the kzalloc (dacl_ptr->size and short ACE SIDs) is that response body from a remote SMB server on TCP/445.
AC:L - After setattr hits id_mode_to_cifs_acl's chown branch, overflow is deterministic: the server returns 1-sub-authority owner ACEs so dacl_ptr->size is compact, while idsfromsid builds a 3-sub-authority S-1-5-88 SID and id_to_sid() can return up to 15, and replace_sids_and_copy_aces/cifs_copy_ace writes the expanded ACEs with no race.
PR:N - The attacker is the SMB server answering SMB2_query_acl on the existing tree-connect and holds no uid, share credential, or capability on the client. Local chown_ok/CAP_CHOWN belongs to the victim who issues chown/chgrp, not to the server.
UI:R - The overflowing allocation is only in id_mode_to_cifs_acl's ATTR_UID/ATTR_GID (chown/chgrp) branch from cifs_setattr_nounix, so a user must chown(2) or chgrp(2) a file on a cifsacl, modefromsid, or posix_extensions CIFS mount of the attacker's share; lookup/stat/read never rewrite that DACL.
S:U - The overflow is of the kmalloc'd pnntsd buffer inside id_mode_to_cifs_acl/build_sec_desc on the CIFS client host and stays in that kernel's own authority; it is not a VM, IOMMU, or sandbox escape.
C:H - replace_sids_and_copy_aces heap-overflows pnntsd in build_sec_desc (KASAN slab-out-of-bounds write of expanded ACE/SID bytes). Corrupting neighboring slab objects is a kernel-memory disclosure primitive, so confidentiality is High.
I:H - cifs_copy_ace writes server-chosen ACE type/flags/access_req and a longer SID past the end of id_mode_to_cifs_acl's kzalloc buffer, an out-of-bounds heap write that can corrupt adjacent objects and hijack control flow.
A:H - The same out-of-bounds write in build_sec_desc was reported as KASAN slab-out-of-bounds by task chown and can oops or panic the client kernel, fully denying availability.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
Required |
Availability Impact |
High |
AV:N - chown/chgrp reaches id_mode_to_cifs_acl via cifs_setattr_nounix, which fetches the NTSD through get_smb2_acl → SMB2_query_acl (SMB2 QUERY_INFO, InfoType=SMB2_O_INFO_SECURITY). The DACL that undersizes the kzalloc (dacl_ptr->size and short ACE SIDs) is that response body from a remote SMB server on TCP/445.
AC:L - After setattr hits id_mode_to_cifs_acl's chown branch, overflow is deterministic: the server returns 1-sub-authority owner ACEs so dacl_ptr->size is compact, while idsfromsid builds a 3-sub-authority S-1-5-88 SID and id_to_sid() can return up to 15, and replace_sids_and_copy_aces/cifs_copy_ace writes the expanded ACEs with no race.
PR:N - The attacker is the SMB server answering SMB2_query_acl on the existing tree-connect and holds no uid, share credential, or capability on the client. Local chown_ok/CAP_CHOWN belongs to the victim who issues chown/chgrp, not to the server.
UI:R - The overflowing allocation is only in id_mode_to_cifs_acl's ATTR_UID/ATTR_GID (chown/chgrp) branch from cifs_setattr_nounix, so a user must chown(2) or chgrp(2) a file on a cifsacl, modefromsid, or posix_extensions CIFS mount of the attacker's share; lookup/stat/read never rewrite that DACL.
S:U - The overflow is of the kmalloc'd pnntsd buffer inside id_mode_to_cifs_acl/build_sec_desc on the CIFS client host and stays in that kernel's own authority; it is not a VM, IOMMU, or sandbox escape.
C:H - replace_sids_and_copy_aces heap-overflows pnntsd in build_sec_desc (KASAN slab-out-of-bounds write of expanded ACE/SID bytes). Corrupting neighboring slab objects is a kernel-memory disclosure primitive, so confidentiality is High.
I:H - cifs_copy_ace writes server-chosen ACE type/flags/access_req and a longer SID past the end of id_mode_to_cifs_acl's kzalloc buffer, an out-of-bounds heap write that can corrupt adjacent objects and hijack control flow.
A:H - The same out-of-bounds write in build_sec_desc was reported as KASAN slab-out-of-bounds by task chown and can oops or panic the client kernel, fully denying availability.
CVSS 3.1