github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ksmbd: require read control for security information

Browse Source 
SMB2 QUERY_INFO security requests currently return owner, group, and DACL
information without checking the access granted to the opened handle. A
handle opened with only SYNCHRONIZE or READ_ATTRIBUTES can consequently
read the security descriptor.

Require READ_CONTROL when OWNER_SECINFO, GROUP_SECINFO, or DACL_SECINFO
is requested and return STATUS_ACCESS_DENIED otherwise.

This fixes smb2.getinfo.getinfo_access.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Namjae Jeon 2026-07-07 00:25:35 +09:00
parent 10aeff72ab
commit d112661f95
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/smb/server/smb2pdu.c
View File

@ -6425,6 +6425,12 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
if (!fp)
return -ENOENT;
if (addition_info & (OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO) &&
!(fp->daccess & FILE_READ_CONTROL_LE)) {
ksmbd_fd_put(work, fp);
return -EACCES;
}
if (le32_to_cpu(req->OutputBufferLength) < sizeof(struct smb_ntsd)) {
rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL;
ksmbd_fd_put(work, fp);