Unauthenticated Linux ksmbd flaw can disclose information
Original title: ZDI-26-1004: Linux Kernel KSMBD Request Buffer Use of Uninitialized Resource Information Disclosure Vulnerability
Only kernels with ksmbd enabled are affected; ZDI rates the issue CVSS 6.3.
ZDI published ZDI-26-1004, a use of an uninitialized resource in the Linux kernel KSMBD request buffer. Remote attackers can disclose sensitive information without authentication, but only where ksmbd is enabled. ZDI assigned a CVSS rating of 6.3. No CVE, patch, or exploitation status appears in the snippet.
Unconfirmed: No CVE identifier is given in the advisory snippet.
- Advisory identifier is ZDI-26-1004.
- Authentication is not required.
- Only systems with ksmbd enabled are vulnerable.
- ZDI CVSS rating is 6.3.
Impact: Unauthenticated remote disclosure of sensitive information
| Product | Affected |
|---|---|
| Linux Kernel KSMBD | — |
- Vendors
- Linux
- Products
- Linux KernelKSMBD
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.