Use-after-free read of rqp->sr_flags in smb_t2_request_int error path
Summary
On every error path of smb_t2_request_int smb_rq_done(rqp) frees rqp then rqp->sr_flags read on next line to test SMBR_RESTART. Freed slab slot read before any other allocation can reuse in this thread but under concurrent M_SMBRQ pressure another object can land in slot its bytes interpreted as sr_flags. smb_rq_done calls kfree(rqp M_SMBRQ) whenever SMBR_ALLOCED set (always by smb_rq_alloc). Every error path reaches this epilogue. Attacker malicious/MitM SMB server causing TRANS2 error (malformed response). Worst case spurious SMBT2_RESTART retry loop or prevent legitimate retry. [VERIFIED pass2: reproduced - freed slot reoccupied same slot, epilogue read returns occupier flags SMBR_RESTART so UAF read drives retry decision; stash-before-free fix]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2567 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| rig.c | — | 5.1 KB | view raw | |
| build.sh | — | 93 B | view raw | |
| run.sh | — | 90 B | view raw | |
| run.log | — | 340 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
smb2567_run.log: occupier==rqp YES; epilogue read 0x10 from the freed slot
PoC changes
smb_rq_done verbatim; M_SMBRQ-equivalent local zone (netsmb.ko not shipped standalone)
Verified recommended fix
read sr_flags into a local before smb_rq_done (in combined fix kernel)
Verdict
smb_t2_request_ints epilogue (smb_rq.c:740-746) calls smb_rq_done(rqp) (kfree at :746 path) and THEN reads rqp->sr_flags for the SMBR_RESTART decision. Rig running the verbatim smb_rq_done + epilogue read: after the free, a same-zone allocation reoccupied the freed slot (occupier==rqp: YES) with sr_flags=0x10 (SMBR_RESTART); the epilogue read then returned 0x10 -- the restart decision was driven by bytes written to the freed slot AFTER the free. Control (read before free) and fixed model (stash before done) both return the pre-free value. Worst case as filed: spurious SMBT2_RESTART retry (malicious/MitM SMB server); legacy smb stack.
No comments yet.