Re: ZDI-CAN-33549: New Vulnerability Report

[Stefan Metzmacher]

Am 23.10.26 um 12:36 schrieb Namjae Jeon:
> On Fri, Oct 23, 2026 at 6:04 PM Stefan Metzmacher <metze@xxxxxxxxx> wrote:
> > Am 22.10.26 um 00:16 schrieb Stefan Metzmacher via samba-technical:
> > > Hi HYEONTAE LEE,
> > >
> > > would you be able to test if this is reproducable on this branch:
> > > https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/for-7.5/smbdirect
> > > git clone -b for-7.5/smbdirect  https://git.samba.org/metze/linux/wip.git for-7.5-smbdirect
> > >
> > > I guess it's already fixed with that.
> > >
> > > Thanks!
> > > metze
> > >
> > > Am 21.10.26 um 23:16 schrieb zdi-disclosures@xxxxxxxxxxxxxx:
> > > > ZDI-CAN-33549: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability
> > > >
> > > > -- CVSS -----------------------------------------
> > > >
> > > > 9.0: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
> > > >
> > > > -- ABSTRACT -------------------------------------
> > > >
> > > > Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
> > > > Linux - Kernel KSMBD
> > > >
> > > > -- VULNERABILITY DETAILS ------------------------
> > > > * Version Tested:7.3-rc3
> > > > * Platform Tested:debian trixie
> > > >
> > > > ---
> > > >
> > > > ### Analysis
> > > >
> > > > integer underflow in smbdirect_connection_rdma_xmit()
> > > > The reproduce kernel built with CONFIG_SMB_SERVER_SMBDIRECT=y + CONFIG_RDMA_RXE=y
> > > > Here is the target requirement
> > > > 1) RDMA device
> > > > 2) writable share
> > > > 3) smb direct (ubuntu only)
> > > >
> > > > ~~~C++
> > > > int smbdirect_connection_rdma_xmit(struct smbdirect_socket *sc,
> > > >                     void *buf, size_t buf_len,
> > > >                     struct smbdirect_buffer_descriptor_v1 *desc,
> > > >                     size_t desc_len,
> > > >                     bool is_read)
> > > > {
> > > > ...
> > > >      for (i = 0; i < desc_len / sizeof(*desc); i++) {
> > > >          if (!buf_len)
> > > >              break;
> > > >
> > > >          desc_buf_len = le32_to_cpu(desc[i].length);
> > > >          if (!desc_buf_len)
> > > >              return -EINVAL;
> > > >
> > > >          if (desc_buf_len > buf_len) {
> > > >              desc_buf_len = buf_len;
> > > >              desc[i].length = cpu_to_le32(desc_buf_len);
> > > >              buf_len = 0;                                            // (1)
> > > >          }
> > > >
> > > >          credits_needed += smbdirect_connection_calc_rw_credits(sc,
> > > >                                         desc_buf,
> > > >                                         desc_buf_len);
> > > >          desc_buf += desc_buf_len;
> > > >          buf_len -= desc_buf_len;                                    // (2) integer underflow, and leads to heap overflow within rxe_mr_copy()
> > > >          desc_num++;
> > > >      }
> >
> > As far as I can see the problem is solved in by patches,
> > but we should have a simple fix first.
> >
> > I think removing ' buf_len = 0;' should be enough for a quick fix,
> > then 'buf_len -= desc_buf_len;' will result in buf_len == 0 and the next
> > iteration will break with if (!buf_len).
> >
> > Namjae, do you agree? Can you create such a quick fix?
> Agreed, Please check the attached patch.
> Thanks for checking this issue!

Thanks, looks good.
metze