Threat intel
Two CVSS 9.0 Linux KSMBD Remote Code Execution Flaws Disclosed Publicly Before Kernel Fixes
Two remote code execution flaws in the Linux kernel's KSMBD SMB server, each rated CVSS 9.0 by Trend Micro's Zero Day Initiative, have been disclosed on public mailing lists before fixes landed in the mainline kernel. One flaw can be triggered before any network authentication.
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution vulnerabilities, each carrying a CVSS score of 9.0 as assessed by Trend Micro's Zero Day Initiative (ZDI), according to The Hacker News.
The two flaws were disclosed on public mailing lists before corresponding fixes were available in the mainline Linux kernel, leaving systems potentially exposed in the interim.
The first vulnerability, tracked as ZDI-CAN-33774, is particularly severe because it can be triggered before any network authentication takes place. This means an unauthenticated attacker with network access to a vulnerable KSMBD server could potentially exploit the flaw remotely.
The second vulnerability, tracked as ZDI-CAN-33549, has a narrower attack surface. Exploitation requires the SMB Direct transport and an RDMA-capable network, which limits the range of environments in which it can be abused.
At the time of reporting, no fix for either flaw had landed in the mainline kernel, the report said. The public disclosure ahead of patched code means administrators running KSMBD should be aware that exploit-relevant technical details are already circulating openly.
KSMBD is an in-kernel implementation of the SMB file-sharing protocol, used in some Linux-based servers and appliances to provide Windows-compatible file sharing. Because it operates in kernel space, successful exploitation of remote code execution flaws in KSMBD can carry elevated risk compared with user-space services.
The details above come from The Hacker News. Organizations exposing KSMBD on the network should monitor kernel security updates and apply fixes as soon as they become available.
Source: The Hacker News
