PT-2026-64610 · Linux · Linux
CVE-2026-64389
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate NTLMv2 response before updating session key
ksmbd auth ntlmv2() derives the NTLMv2 session key into
sess->sess key before it verifies the NTLMv2 response.
ksmbd decode ntlmssp auth blob() then continues into KEY XCH even
when ksmbd auth ntlmv2() failed.
With SMB3 multichannel binding, the failed authentication operates on
an existing session and the session setup error path does not expire
binding sessions. A client can send a binding session setup with a
bad NT proof and KEY XCH and still modify sess->sess key before
STATUS LOGON FAILURE is returned.
Relevant path:
smb2 sess setup()
-> conn->binding = true
-> ntlm authenticate()
-> session user()
-> ksmbd decode ntlmssp auth blob()
-> ksmbd auth ntlmv2()
-> calc ntlmv2 hash()
-> hmac md5 usingrawkey(..., sess->sess key)
-> crypto memneq() returns mismatch
-> KEY XCH arc4 crypt(..., sess->sess key, ...)
-> out err without expiring the binding session
Derive the base session key into a local buffer and copy it to
sess->sess key only after the proof matches. Return immediately on
authentication failure so KEY XCH is only processed after successful
authentication.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux