In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() set work->next_smb2_rcv_hdr_off as zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Consequently, is_chained_smb2_message() continues to point to the same request header instead of advancing. If the header's NextCommand field is non-zero, the function returns true, causing __handle_ksmbd_work() to repeatedly process the same failed request in an infinite loop. This results in the kernel log being flooded with "bad smb2 signature" messages and high CPU usage. This patch fixes the issue by changing the return value from SERVER_HANDLER_CONTINUE to SERVER_HANDLER_ABORT. This ensures that the processing loop terminates immediately rather than attempting to continue from an invalidated offset.
Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux: ksmbd: corrige un bucle infinito causado por el reinicio de next_smb2_rcv_hdr_off en las rutas de error El problema ocurre cuando una solicitud firmada falla la verificación de firma smb2. En __process_request(), si check_sign_req() devuelve un error, se llama a set_smb2_rsp_status(work, STATUS_ACCESS_DENIED). set_smb2_rsp_status() establece work->next_smb2_rcv_hdr_off a cero. Al reiniciar next_smb2_rcv_hdr_off a cero, el puntero al siguiente comando en la cadena se pierde. En consecuencia, is_chained_smb2_message() continúa apuntando a la misma cabecera de solicitud en lugar de avanzar. Si el campo NextCommand de la cabecera no es cero, la función devuelve verdadero, lo que hace que __handle_ksmbd_work() procese repetidamente la misma solicitud fallida en un bucle infinito. Esto resulta en el registro del kernel siendo inundado con mensajes de 'firma smb2 incorrecta' y un alto uso de CPU. Este parche corrige el problema cambiando el valor de retorno de SERVER_HANDLER_CONTINUE a SERVER_HANDLER_ABORT. Esto asegura que el bucle de procesamiento termine inmediatamente en lugar de intentar continuar desde un desplazamiento invalidado.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-835
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7f7638068180> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7f7600788740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7f763806a900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7f763806a4c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7f76394ce5c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7f76394ccd40> | Operating System |
| linux | linux_kernel | 6.6 | <built-in method update of dict object at 0x7f763806af80> | Operating System |
| linux | linux_kernel | 6.6 | <built-in method update of dict object at 0x7f763806b6c0> | Operating System |
| linux | linux_kernel | 6.6 | <built-in method update of dict object at 0x7f7638068200> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.6:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.6:rc7:*:*:*:*:*:* |