Heap Out-of-Bounds Read in libsmb2

Executive Summary

This vulnerability is a heap out-of-bounds read in the libsmb2 library affecting versions up to 6.2. It occurs in the smb2_decode_file_all_info function where an unchecked FileNameLength value can cause the client to read beyond allocated memory. Attackers controlling an SMB server or performing man-in-the-middle attacks on unsigned sessions can exploit this by sending crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in libsmb2-based clients when connecting to SMB servers. Check for heap out-of-bounds read errors in logs or use AddressSanitizer during client operations like smb2_stat or smb2_fstat. Inspect network traffic for malformed FileAllInformation replies with unusually large FileNameLength values.

Useful 0 Not Useful 0

Impact Analysis

If you use libsmb2 in your applications, this vulnerability could allow attackers to crash your client software by sending malicious SMB server responses. This could lead to denial of service, application instability, or potential further exploitation depending on the environment and system configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a technical flaw in the libsmb2 library causing client crashes. However, if exploited in systems handling sensitive data, it could lead to denial-of-service conditions, potentially disrupting access to protected information and indirectly affecting compliance by failing to maintain availability of critical systems.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libsmb2 to the latest patched version. Avoid connecting to untrusted SMB servers. Enable SMB signing and encryption in client configurations. Use network monitoring to detect suspicious QUERY_INFO replies with abnormal FileNameLength values.

Useful 0 Not Useful 0