SMBleed could allow a remote attacker to leak kernel memory
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0796 | Unauthenticated RCE in Microsoft SMBv3 (SMBGhost) CVE-2020-0796 ('SMBGhost') is a memory-corruption (CWE-119) flaw in Microsoft's Server Message Block 3.1.1 (SMBv3) implementation, in which certain crafted requests — notably malformed compressed SMBv3 messages — can corrupt memory on the target. An unauthenticated remote attacker can trigger it by sending specially crafted SMBv3 packets directly to any SMB-enabled host, with no credentials or user interaction required. Successful exploitation yields arbitrary code execution on the target server or client, giving the attacker full control of the host, and the flaw was widely characterized as wormable because a compromised host can then attack others. Any Windows system running SMBv3 is affected — SMBv3 is enabled by default on modern Windows 10 and Windows Server builds, with Windows 10 versions 1903/1909 and Windows Server 2019/versions 1903/1909 identified in Microsoft's advisory. Exploitation is confirmed in the wild: the CVE is in CISA KEV (added 2022-02-10) with known ransomware use, EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), and no public PoC is listed in the source data. Do: Apply Microsoft's updates per vendor instructions immediately, prioritizing Windows 10 1903/1909 and Windows Server 2019/1903/1909 hosts and anything with SMB (TCP 445) reachable by untrusted networks. Until patched, disable SMBv3 compression per Microsoft's mitigation guidance (setting DisableCompression=1 under LanmanServer) and restrict inbound TCP 445 to trusted sources. Given confirmed ransomware use, hunt for post-exploitation activity on unpatched hosts. | 10.0 | 100% | KEV ransomware PoC ×2 |
| masstens of millions of Windows hosts with SMBv3 enabled; on the order of 1M+ hosts with SMB (TCP 445) exposed to the internet per public scans | |
| CVE-2020-1206 | An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'. NVD description · AI analysis pending | 7.5 | 10% |
| — |
Full article475 words · extracted from securityaffairs.com · click to collapse
Microsoft addressed a Server Message Block (SMB) protocol issue, named SMBleed, that could allow an attacker to leak kernel memory remotely, without authentication.
Recently released Microsoft June 2020 Patch Tuesday updates also address a vulnerability in the Server Message Block (SMB) protocol dubbed SMBleed (CVE-2020-1206) that could allow an attacker to leak kernel memory remotely, without authentication.
The SMBleed vulnerability could be exploited along with other issues to remotely execute arbitrary code.
The vulnerability could be chained with the SMBGhost (CVE-2020-0796) to achieve pre-authentication remote code execution.
The SMBleed flaw was discovered by researchers at ZecOps while they were analyzing the vulnerable function of SMBGhost, it resides in the compression mechanism implemented in the SMBv3.1.1 and affects the way the protocol handles certain requests.
“As we found during our research, it’s not the only bug in the SMB decompression functionality. SMBleed happens in the same function as SMBGhost. The bug allows an attacker to read uninitialized kernel memory, as we illustrated in detail in this writeup.” reads the analysis published by ZecOps.
“An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.” reads the advisory published by Microsoft.
“To exploit the vulnerability against a server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it.”
The SMBleed flaw impacts Windows 10 and Windows Server, versions 1903, 1909 and 2004, previous versions of the Microsoft OS are not affected.
Microsoft has provided workarounds to prevent the exploitation of this vulnerability, such as disabling SMBv3 compression using the following PowerShell command:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -ForceMicrosoft pointed out that this workaround does not prevent the exploitation of SMB clients and recommends installing the available patches.
ZecOps experts explained that it is possible to remediate both SMBleed and SMBGhost by doing one or more of the following things:
- Windows update will solve the issues completely (recommended)
- Blocking port 445 will stop lateral movements using these vulnerabilities
- Enforcing host isolation
- Disabling SMB 3.1.1 compression (not a recommended solution)
ZecOps’ researchers published proof-of-concept (POC) code for exploiting the vulnerability (SMBGhost + SMBleed RCE POC Source Code).
“Exploiting the SMBleed bug without authentication is less straightforward, but also possible. We were able to use it together with the SMBGhost bug to achieve RCE (Remote Code Execution). A writeup with the technical details will be published soon. For now, please see below a POC demonstrating the exploitation.” continues the post.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – SMBleed, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/104584/hacking/microsoft-vulnerability-smbleed.html