Two unfixed Linux KSMBD flaws allow remote code execution, CVSS 9.0
Original title: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
One flaw needs no authentication on port 445; neither has a CVE or a confirmed mainline fix.
Trend Micro's Zero Day Initiative publicly reported two remote code execution flaws in Linux KSMBD, each rated CVSS 9.0, with no named fix yet in the mainline kernel or linux-next. ZDI-CAN-33774 is an unauthenticated race in protocol-handler assignment on port 445. ZDI-CAN-33549 is an integer underflow on the SMB Direct path and needs an RDMA-capable interface, a writable share, and SMB Direct. The kernel project assigns CVEs only after a stable-tree fix. Three other public ZDI kernel reports cover local privilege escalation or information disclosure outside KSMBD, plus a separate ConnMan buffer overflow.
Unconfirmed: Phoronix reported a submitted fix for ZDI-CAN-33549, but that has not been confirmed elsewhere, and no exploitation is stated.
- ZDI-CAN-33774 is pre-authentication and affects any server running KSMBD.
- ZDI-CAN-33549 needs SMB Direct, RDMA, and a writable KSMBD share.
- Phoronix said Stefan Metzmacher submitted a fix aimed at the next cycle.
- Red Hat Enterprise Linux does not include KSMBD by default.
- systemctl status ksmbd or lsmod | grep ksmbd shows whether the module is active.
Impact: Remote code execution on servers running KSMBD
| Product | Affected |
|---|---|
| Linux KSMBD | — |
| Linux kernel networking (skb_zerocopy) | — |
| VMware vmwgfx | — |
| Linux nvmet | — |
| ConnMan | — |
- 1.Check whether KSMBD is loaded with systemctl status ksmbd or lsmod | grep ksmbd.
- 2.Treat public ZDI reports ZDI-CAN-33774 and ZDI-CAN-33549 as unfixed until a stable-tree fix ships.
- Organizations
- Zero Day Initiative
From the original article
3 min read at thehackernews.com
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9. 0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.