Linux servers utilizing KSMBD, a component of the kernel’s SMB server, are currently susceptible to two significant remote code execution (RCE) vulnerabilities. These flaws, reported by Trend Micro’s Zero Day Initiative, have been assigned a critical severity score of 9.0. However, the mainline Linux kernel has yet to issue patches to address these issues.
Details of the Vulnerabilities
The first vulnerability, identified as ZDI-CAN-33774, poses a serious risk as it can be exploited without any network authentication. This flaw affects any server operating KSMBD on port 445, making it highly accessible to potential attackers. The second vulnerability, ZDI-CAN-33549, requires a more specific setup, including an RDMA-capable network interface and the use of SMB Direct transport. This flaw arises from an integer underflow that can lead to buffer overflows, compromising server memory.
Technical Insights
ZDI-CAN-33549’s risk lies in its ability to manipulate RDMA buffer descriptors, causing memory to overflow beyond allocated limits. This requires a writable KSMBD share and negotiation over SMB Direct. On the other hand, ZDI-CAN-33774 involves a race condition in KSMBD’s handler allocation, triggered by a sequence of crafted SMB packets, potentially allowing unauthorized data writes.
Despite the seriousness of these flaws, no fixes have been incorporated into the mainline kernel or the linux-next integration branch. Although Stefan Metzmacher, an SMB Direct maintainer, has reportedly submitted a patch for ZDI-CAN-33549, confirmation is pending.
Implications and Future Outlook
The absence of immediate kernel fixes means systems remain at risk. Security patches typically take weeks to propagate through mainline to stable branches. Notably, these vulnerabilities have not yet been assigned CVE identifiers, as this occurs only post-stable-tree patching.
TrendAI, Trend Micro’s AI-driven tool, is credited with discovering these flaws, reflecting the growing role of AI in cybersecurity. The Linux community is urged to stay alert and monitor updates, especially as Red Hat Enterprise Linux does not include KSMBD by default, potentially reducing exposure.
In response to these reports, stable-kernel maintainer Greg Kroah-Hartman highlighted procedural issues in report submissions, stressing the need for proper patch inclusion before public disclosure.
In conclusion, while the vulnerabilities in KSMBD are critical, ongoing efforts within the Linux community aim to resolve these issues, with users advised to closely follow updates and employ interim security measures to safeguard their systems.
