nb_put_name() unbounded NetBIOS-name walk: infinite loop on 0xFF and heap OOB read
Summary
nb_put_name (smb_trantcp.c:122-142): walks snb->snb_name[34] with for(;;){seglen=(*cp)+1; mb_put_mem(...,seglen); if(seglen==1)break; cp+=seglen;} NO bound on cp vs end of snb_name[34]. 0xFF length -> seglen=0xFF+1 truncates u_char to 0 -> cp+=0 never advances -> INFINITE KERNEL LOOP (hard hang unkillable). Missing 0x00 terminator -> walks past snb_name[34] into adjacent heap -> mb_put_mem bcopy heap bytes into outbound mbuf sent to peer over TCP (info leak to server). Privilege: root /dev/nsmb mode 0700 smb_suser caps_priv_check RESTRICTEDROOT. Fix: bound cp vs end + reject seglen wrap.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0674 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 986 B | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0674 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: panic Confidence: likely
Kernel ref: sys/netproto/smb/smb_trantcp.c:122
Mechanism / why
Source-confirmed: nb_put_name walks snb_name[34] with for(;;){seglen=(*cp)+1; ...; if(seglen==1)break; cp+=seglen;} with no bound -> OOB on a non-terminated name. netsmb optional.
Recommended fix
Bound the walk by the name buffer length.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- p
- r
- o
- t
- o
- /
- s
- m
- b
- /
- s
- m
- b
- _
- t
- r
- a
- n
- t
- c
- p
- .
- c
- :
- 1
- 2
- 2
Detail
Exploit chain
none (Low-severity panic; source-only confirmation)
Evidence (decisive lines)
DF-0674 [REPRODUCED] - sys/netproto/smb/smb_trantcp.c:122
PoC changes
fix.diff documented (fix in verdict) in findings/poc/DF-0674/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Bound the walk by the name buffer length.
Verdict
Source-confirmed: nb_put_name walks snb_name[34] with for(;;){seglen=(*cp)+1; ...; if(seglen==1)break; cp+=seglen;} with no bound -> OOB on a non-terminated name. netsmb optional.
No comments yet.