ACK/Cmnt: [SRU][J][PATCH 0/1] CVE-2025-21947

[Andrei Gherzan]

On 26/09/09 03:50PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-21947
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> ksmbd: fix type confusion via race condition when using ipc_msg_send_request
> 
> req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc.
> req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be
> same and it could lead to type confusion between messages, resulting in access
> to unexpected parts of memory after an incorrect delivery. ksmbd check type of
> ipc response but missing add continue to check next ipc reponse.
> 
> The ksmbd server allocates IPC message handles from a shared IDA pool that is
> used both by login requests and by FSCTL_PIPE_TRANSCEIVE ioctls. Because the
> same handle value can be handed out to different request types, a response may
> be matched to the wrong pending request. When ksmbd validates the response
> type and finds a mismatch, it fails to continue looking for the correct
> response, so a message can be interpreted as a different structure than the one
> it actually is. This type confusion allows a remote client to cause the server
> to access unexpected regions of kernel memory.
> 
> [ Fix ]
> 
> jammy/linux: backported from e2ff19f0b7a3; backported to jammy/linux; review and refine this note

The backport looks good but note that there is a placeholder comment here.

> 
> The fix ensures that when the IPC response type does not match the expected
> type, the handler continues to scan for the next response rather than acting on
> a mismatched message, closing the type-confusion window introduced by the
> shared handle allocation.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression from this change would be confined to the in-kernel SMB server
> (ksmbd); it could disrupt IPC handling between the kernel module and the
> ksmbd user-space daemon, potentially affecting user authentication or named
> pipe (RPC) traffic for hosts that export SMB shares via ksmbd. Systems that do
> not load or run the ksmbd module, including those serving SMB through Samba's
> user-space smbd or not serving SMB at all, are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: 339f80a1/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/28000e77/attachment.sig>