smb Client Message OOB

Vulnerability analysis

Root Cause: The smb2_dump_detail() function calls server->ops->calc_smb_size(buf) without first validating the SMB message structure. The calc_smb_size() function assumes the buffer contains a valid SMB2 message and reads fields from it to calculate the size. If the buffer contains malformed or truncated data, this can result in reading beyond the buffer boundaries.

Attack Surface: This vulnerability affects the SMB client implementation and can be triggered by a malicious SMB server sending crafted responses. An attacker would need to control an SMB server that the victim connects to, or perform a man-in-the-middle attack on SMB traffic. The vulnerability requires local access to mount SMB shares or network access to influence SMB communications.

Fix Mechanism: The patch adds a validation check using server->ops->check_message() before calling calc_smb_size(). The check_message() function validates the SMB2 header structure, command validity, and message length before allowing size calculation. Additionally, the patch reorders validation checks in smb2_check_message() to perform header validation before length checks, ensuring basic structure validity before accessing fields.