You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
141 lines
4.4 KiB
141 lines
4.4 KiB
From 364275d1ae8c55242497e7c8804fb28aa3b73465 Mon Sep 17 00:00:00 2001
|
|
From: Jeremy Allison <jra@samba.org>
|
|
Date: Fri, 8 Sep 2017 10:13:14 -0700
|
|
Subject: [PATCH] CVE-2017-12163: s3:smbd: Prevent client short SMB1 write from
|
|
writing server memory to file.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13020
|
|
|
|
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/smbd/reply.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 50 insertions(+)
|
|
|
|
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
|
|
index 317143f..7b07078 100644
|
|
--- a/source3/smbd/reply.c
|
|
+++ b/source3/smbd/reply.c
|
|
@@ -4474,6 +4474,9 @@ void reply_writebraw(struct smb_request *req)
|
|
}
|
|
|
|
/* Ensure we don't write bytes past the end of this packet. */
|
|
+ /*
|
|
+ * This already protects us against CVE-2017-12163.
|
|
+ */
|
|
if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
|
|
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
|
error_to_writebrawerr(req);
|
|
@@ -4574,6 +4577,11 @@ void reply_writebraw(struct smb_request *req)
|
|
exit_server_cleanly("secondary writebraw failed");
|
|
}
|
|
|
|
+ /*
|
|
+ * We are not vulnerable to CVE-2017-12163
|
|
+ * here as we are guarenteed to have numtowrite
|
|
+ * bytes available - we just read from the client.
|
|
+ */
|
|
nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
|
|
if (nwritten == -1) {
|
|
TALLOC_FREE(buf);
|
|
@@ -4647,6 +4655,7 @@ void reply_writeunlock(struct smb_request *req)
|
|
connection_struct *conn = req->conn;
|
|
ssize_t nwritten = -1;
|
|
size_t numtowrite;
|
|
+ size_t remaining;
|
|
off_t startpos;
|
|
const char *data;
|
|
NTSTATUS status = NT_STATUS_OK;
|
|
@@ -4679,6 +4688,17 @@ void reply_writeunlock(struct smb_request *req)
|
|
startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
|
|
data = (const char *)req->buf + 3;
|
|
|
|
+ /*
|
|
+ * Ensure client isn't asking us to write more than
|
|
+ * they sent. CVE-2017-12163.
|
|
+ */
|
|
+ remaining = smbreq_bufrem(req, data);
|
|
+ if (numtowrite > remaining) {
|
|
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
|
+ END_PROFILE(SMBwriteunlock);
|
|
+ return;
|
|
+ }
|
|
+
|
|
if (!fsp->print_file && numtowrite > 0) {
|
|
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
|
|
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
|
|
@@ -4756,6 +4776,7 @@ void reply_write(struct smb_request *req)
|
|
{
|
|
connection_struct *conn = req->conn;
|
|
size_t numtowrite;
|
|
+ size_t remaining;
|
|
ssize_t nwritten = -1;
|
|
off_t startpos;
|
|
const char *data;
|
|
@@ -4796,6 +4817,17 @@ void reply_write(struct smb_request *req)
|
|
startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
|
|
data = (const char *)req->buf + 3;
|
|
|
|
+ /*
|
|
+ * Ensure client isn't asking us to write more than
|
|
+ * they sent. CVE-2017-12163.
|
|
+ */
|
|
+ remaining = smbreq_bufrem(req, data);
|
|
+ if (numtowrite > remaining) {
|
|
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
|
+ END_PROFILE(SMBwrite);
|
|
+ return;
|
|
+ }
|
|
+
|
|
if (!fsp->print_file) {
|
|
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
|
|
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
|
|
@@ -5018,6 +5050,9 @@ void reply_write_and_X(struct smb_request *req)
|
|
goto out;
|
|
}
|
|
} else {
|
|
+ /*
|
|
+ * This already protects us against CVE-2017-12163.
|
|
+ */
|
|
if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
|
|
smb_doff + numtowrite > smblen) {
|
|
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
|
@@ -5444,6 +5479,7 @@ void reply_writeclose(struct smb_request *req)
|
|
{
|
|
connection_struct *conn = req->conn;
|
|
size_t numtowrite;
|
|
+ size_t remaining;
|
|
ssize_t nwritten = -1;
|
|
NTSTATUS close_status = NT_STATUS_OK;
|
|
off_t startpos;
|
|
@@ -5477,6 +5513,17 @@ void reply_writeclose(struct smb_request *req)
|
|
mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
|
|
data = (const char *)req->buf + 1;
|
|
|
|
+ /*
|
|
+ * Ensure client isn't asking us to write more than
|
|
+ * they sent. CVE-2017-12163.
|
|
+ */
|
|
+ remaining = smbreq_bufrem(req, data);
|
|
+ if (numtowrite > remaining) {
|
|
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
|
+ END_PROFILE(SMBwriteclose);
|
|
+ return;
|
|
+ }
|
|
+
|
|
if (fsp->print_file == NULL) {
|
|
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
|
|
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
|
|
@@ -6069,6 +6116,9 @@ void reply_printwrite(struct smb_request *req)
|
|
|
|
numtowrite = SVAL(req->buf, 1);
|
|
|
|
+ /*
|
|
+ * This already protects us against CVE-2017-12163.
|
|
+ */
|
|
if (req->buflen < numtowrite + 3) {
|
|
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
|
END_PROFILE(SMBsplwr);
|
|
--
|
|
1.9.1
|
|
|
|
|