Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two critical remote code execution vulnerabilities rated 9.0 have been disclosed in Linux's KSMBD SMB server before kernel fixes are available.
Linux servers running KSMBD, the kernel's built-in SMB server, face significant security risks due to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative. No fixes have yet been incorporated into the mainline kernel, leaving systems vulnerable to potential attacks.
The first vulnerability, ZDI-CAN-33774, can be triggered before any network authentication, exposing any server running KSMBD on port 445. The second flaw, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface to exploit.
Technical Details
ZDI-CAN-33549 involves an integer underflow in KSMBD's SMB Direct path. Attackers can supply RDMA buffer descriptors where the first is longer than the declared payload, causing the server's size counter to wrap and enabling a memory copy to overrun allocated buffer boundaries. Exploitation requires three conditions: an RDMA-capable interface, a writable KSMBD share, and a client negotiating SMB Direct.
ZDI-CAN-33774 exploits a race condition in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to handle SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. An alternative path to buffer overwriting exists once an attacker gains access to a share.
Current Status
As of Thursday, neither vulnerability has a named fix in the mainline kernel or in linux-next, the integration tree that feeds it. According to Linux news site Phoronix, SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle, though this hasn't been confirmed elsewhere.
For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this.
Fixes typically take weeks to reach stable branches and distribution kernels after being implemented in mainline. Neither flaw has received a CVE identifier, as the kernel project assigns those only after a stable-tree fix becomes available. Users can check if the KSMBD module is active by running 'systemctl status ksmbd' or 'lsmod | grep ksmbd'.
Related
