Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed Before Kernel Fixes
Trend Micro's Zero Day Initiative rated both KSMBD remote code execution flaws 9.0. One can be triggered before any network authentication, and no mainline kernel fix was available at disclosure.
Linux servers running KSMBD, the SMB server built into the kernel, were exposed to two publicly reported remote code execution flaws when the details went out on public mailing lists. Trend Micro's Zero Day Initiative rated both 9.0, and at the time of the report there was no fix in the mainline kernel.
The two issues differ in what an attacker needs first. One, tracked as ZDI-CAN-33774, can be triggered before any network authentication, which puts it in reach of anyone who can send traffic to the service. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network.
The disclosure timing is the part defenders should note. Details reached public mailing lists ahead of kernel fixes, so administrators had little room to patch before the technical information was out. The source did not describe a working exploit, and it did not name affected kernel versions or a patch schedule.
For teams running KSMBD, the practical questions are whether the service is enabled at all and whether it needs to be reachable from untrusted networks. Where it isn't required, disabling it removes the exposure. Where it is, restricting who can reach the SMB port and watching for unusual activity against it are the obvious steps while fixes are pending. The source offered no further mitigation guidance.
Sources
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel FixesPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning