🔴 Critical: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
-
Linux servers running KSMBD, the SMB server built directly into the kernel, are currently exposed to two remote code execution flaws that Trend Micro's Zero Day Initiative has rated 9.0 on the CVSS scale. The details were disclosed on public mailing lists, and as of now no fix has landed in the mainline kernel.
The two issues are tracked as ZDI-CAN-33774 and ZDI-CAN-33549. The first is the more dangerous of the pair, since it can be triggered before any network authentication takes place. The second requires the SMB Direct transport along with an RDMA-capable network to be exploited.
Key points for defenders:
- Both flaws affect KSMBD, so any Linux server with the in-kernel SMB server enabled should be reviewed.
- ZDI-CAN-33774 is pre-authentication, meaning exposure does not depend on valid credentials.
- ZDI-CAN-33549 is narrower in scope, requiring SMB Direct and RDMA-capable networking.
- No mainline kernel fix is available at the time of disclosure.
Given that the flaws were reported publicly before patches were merged, administrators running KSMBD should treat this as urgent: consider disabling or restricting the service where it isn't strictly needed, and monitor kernel updates closely for fixes.
Source: [email protected] (The Hacker News)
Is your organization running KSMBD in production, and if so, are you disabling it or waiting for kernel patches?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login