Heap Out-of-Bounds Read in libsmb2

Executive Summary

This vulnerability is a heap out-of-bounds read in the libsmb2 library versions up to 6.2. It affects two functions, smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info, which decode filesystem information from SMB server responses. These functions read a 32-bit length value for volume labels or filesystem names but fail to validate if the length exceeds the available data in the received reply. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using libsmb2 version 6.2 or earlier when processing SMB2 QUERY_INFO replies. Use AddressSanitizer during testing to identify heap out-of-bounds reads. Inspect network traffic for malformed SMB2 responses with oversized name lengths or missing validation in filesystem info decoders.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to crash client applications that use the libsmb2 library by sending maliciously crafted SMB server responses. If exploited, it could lead to denial-of-service conditions, application instability, or potential unauthorized memory access. Users relying on libsmb2 for SMB2/SMB3 network share access may experience crashes when connecting to malicious or compromised servers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or unauthorized data exposure. A heap out-of-bounds read may allow attackers to crash client applications or leak sensitive information, which could violate data integrity and confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade libsmb2 to a patched version that includes bounds checking in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info. Avoid connecting to untrusted SMB servers. Disable SMB2/3 if not required. Monitor for crashes in client applications and apply vendor patches promptly.

Useful 0 Not Useful 0