Bug 1206654 - (CVE-2022-47939) VUL-0: CVE-2022-47939: kernel: ksmbd: remote code execution due to use after free ZDI-22-1690
(CVE-2022-47939)
VUL-0: CVE-2022-47939: kernel: ksmbd: remote code execution due to use after ...
Status: RESOLVED INVALID
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P1 - Urgent : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/351680/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-12-23 07:37 UTC by Marcus Meissner
Modified: 2023-03-08 09:10 UTC (History)
8 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2022-12-23 07:37:58 UTC
https://www.zerodayinitiative.com/advisories/ZDI-22-1690/

CVE ID 	
CVSS SCORE 	10.0, (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
AFFECTED VENDORS 	Linux
AFFECTED PRODUCTS 	Kernel
VULNERABILITY DETAILS 	

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.

The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
ADDITIONAL DETAILS 	Linux has issued an update to correct this vulnerability. More details can be found at:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.61
DISCLOSURE TIMELINE 	

    2022-07-26 - Vulnerability reported to vendor
    2022-12-22 - Coordinated public release of advisory

CREDIT 	Arnaud Gatignol, Quentin Minster, Florent Saudel, Guillaume Teissier (@thalium_team)
Comment 1 Marcus Meissner 2022-12-23 07:41:57 UTC
The issue is affecting Linux Kernel 5.13+ , so only SLES 15 SP4 and Tumbleweed would be affected.

CONFIG_SMB_SERVER is NOT enabled in SLES 15 SP4 -> not affected
Comment 2 Marcus Meissner 2022-12-23 07:42:19 UTC
commit a54c509c32adba9d136f2b9d6a075e8cae1b6d27
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Thu Jul 28 21:57:08 2022 +0900

    ksmbd: fix use-after-free bug in smb2_tree_disconect
    
    commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c upstream.
    
    smb2_tree_disconnect() freed the struct ksmbd_tree_connect,
    but it left the dangling pointer. It can be accessed
    again under compound requests.
    
    This bug can lead an oops looking something link:
    
    [ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807
    ...
    [ 1685.468130 ] Call Trace:
    [ 1685.468132 ]  <TASK>
    [ 1685.468135 ]  dump_stack_lvl+0x49/0x5f
    [ 1685.468141 ]  print_report.cold+0x5e/0x5cf
    [ 1685.468145 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468157 ]  kasan_report+0xaa/0x120
    [ 1685.468194 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468206 ]  __asan_report_load4_noabort+0x14/0x20
    [ 1685.468210 ]  ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468222 ]  smb2_tree_disconnect+0x175/0x250 [ksmbd]
    [ 1685.468235 ]  handle_ksmbd_work+0x30e/0x1020 [ksmbd]
    [ 1685.468247 ]  process_one_work+0x778/0x11c0
    [ 1685.468251 ]  ? _raw_spin_lock_irq+0x8e/0xe0
    [ 1685.468289 ]  worker_thread+0x544/0x1180
    [ 1685.468293 ]  ? __cpuidle_text_end+0x4/0x4
    [ 1685.468297 ]  kthread+0x282/0x320
    [ 1685.468301 ]  ? process_one_work+0x11c0/0x11c0
    [ 1685.468305 ]  ? kthread_complete_and_exit+0x30/0x30
    [ 1685.468309 ]  ret_from_fork+0x1f/0x30
    
    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Cc: stable@vger.kernel.org
    Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Comment 3 Marcus Meissner 2022-12-23 07:42:35 UTC
commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Thu Jul 28 21:57:08 2022 +0900

    ksmbd: fix use-after-free bug in smb2_tree_disconect
    
    smb2_tree_disconnect() freed the struct ksmbd_tree_connect,
    but it left the dangling pointer. It can be accessed
    again under compound requests.
    
    This bug can lead an oops looking something link:
    
    [ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807
    ...
    [ 1685.468130 ] Call Trace:
    [ 1685.468132 ]  <TASK>
    [ 1685.468135 ]  dump_stack_lvl+0x49/0x5f
    [ 1685.468141 ]  print_report.cold+0x5e/0x5cf
    [ 1685.468145 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468157 ]  kasan_report+0xaa/0x120
    [ 1685.468194 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468206 ]  __asan_report_load4_noabort+0x14/0x20
    [ 1685.468210 ]  ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
    [ 1685.468222 ]  smb2_tree_disconnect+0x175/0x250 [ksmbd]
    [ 1685.468235 ]  handle_ksmbd_work+0x30e/0x1020 [ksmbd]
    [ 1685.468247 ]  process_one_work+0x778/0x11c0
    [ 1685.468251 ]  ? _raw_spin_lock_irq+0x8e/0xe0
    [ 1685.468289 ]  worker_thread+0x544/0x1180
    [ 1685.468293 ]  ? __cpuidle_text_end+0x4/0x4
    [ 1685.468297 ]  kthread+0x282/0x320
    [ 1685.468301 ]  ? process_one_work+0x11c0/0x11c0
    [ 1685.468305 ]  ? kthread_complete_and_exit+0x30/0x30
    [ 1685.468309 ]  ret_from_fork+0x1f/0x30
    
    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Cc: stable@vger.kernel.org
    Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index c545c41b0364..43bc027a50f2 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -2057,6 +2057,7 @@ int smb2_tree_disconnect(struct ksmbd_work *work)
 
        ksmbd_close_tree_conn_fds(work);
        ksmbd_tree_conn_disconnect(sess, tcon);
+       work->tcon = NULL;
        return 0;
 }
Comment 4 Marcus Meissner 2022-12-23 08:27:30 UTC
correction, git tag --contains e2f34481b24d  shows 5.15 and newer.

SLES 15 SP4 does not have the code.
Comment 5 Petr Mladek 2023-01-02 11:14:49 UTC
I could confirm that the buggy code is not in any released kernel, except from OpenSUSE:Factory.

The fix was added into upstream v6.0-rc1 so even OpenSUSE:Factory should be on the safe side.

Adding peopled from the Samba team that are familiar with CIFS just in
case the buggy code gets backported in the future.

Reassigning back to the security team for further tracking.