ksmbrace

ksmbrace Schwachstellenforschung in ksmbd , dem SMB3-Server im Linux-Kernel fs/smb/server/. Schwachstellen für authentifizierte Angreifer auf den Durable-Handle- und Pfadauflösungspfaden von ksmbd. Der Name spielt auf das Race-Condition-Thema dieser Arbeit an siehe die zurückgehaltene...

SMB-LINUX-CVE-2025-37899

Vulnerabilidade Use-After-Free no ksmbd do Kernel do Linux CVE-2025-37899 Descrição Foi descoberta uma vulnerabilidade do tipo use-after-free no módulo ksmbd do kernel do Linux, responsável pela implementação do protocolo SMB Server Message Block para compartilhamento de arquivos em rede. Esta...

CVE-2025-38561

CVE-2025-38561 ksmbd: Condizione di gara su PreauhHashValue Se il client invia più richieste di sessione a ksmbd, potrebbe verificarsi una condizione di gara su PreauhHashValue...

KSMBD-CVE-2025-37947

PoC per CVE-2025-37947 per ksmbd Per maggiori informazioni, consulta l'articolo qui. File bpf-tracer.sh - tracer BPF per msgmsg CVE-2025-37947.c - exploit per CVE-2025-37947 proof-of-concept.c - trigger minimale che causa la scrittura OOB ksmbd.conf - configurazione di ksmbd Makefile - compila...

KSMBDrain

Panoramica Exploit proof-of-concept per KSMBDrain CVE-2025-38501. Consente di esaurire da remoto il limite di connessioni del server KSMBD. Dettagli Un attaccante remoto può esaurire il limite massimo di connessioni di un server KSMBD eseguendo il three-way handshake TCP e poi non rispondendo ai...

ksmbd-n-day

README Dieses Repository begleitet meinen Forschungsartikel Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in dem ich einen POC für N-Days aus dem Jahr 2023 entwickle: CVE-2023-52440 und CVE-2023-4130. Ich stelle die Kernel-Konfiguration .config, ein Kernel-Startskrip...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verifyremainingdatalength respects maxfragmentedrecvsize This issue is related to the check for dataoffset + datalength...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: fixed a possible memory leak in smb2lock. argv needs to be freed when setupasyncwork fails, or when the current process is awakened...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed a slab-out-of-bounds issue in initsmb2rsphdr When smb1 mounting fails, KASAN detects a slab-out-of-bounds issue in initsmb2rsphdr, as follows. For smb1’s negotiate56 bytes, initsmb2rsphdr is called for smb2. The issu...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Validates the session ID and tree ID in compound requests. The function smb2getmsg in smb2getksmbdtcon and smb2checkusersession always returns the first command in a compound request’s headers. If SMB2TREECONNECTHE is the...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel. A deadlock occurs when multiple session setup requests are sent simultaneously, which may lead to a denial of service...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a potential out-of-bounds write issue in getfileallinfo for compound requests. When a compound request consists of QUERYDIRECTORY + QUERYINFO FILEALLINFORMATION, and the first command consumes nearly the entire...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: transportipc: Validate the payload size before reading the handle. The handleresponse function dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed o...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: A missing return value check bug has been fixed. In the smb2sendinterimresp function, if ksmbdallocworkstruct fails to allocate a node, it returns a NULL pointer to the inwork pointer. This can lead to an illegal memory...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel. A memory leak may occur if a client sends a session setup request with an unknown NTLMSSP message type, potentially leading to resource exhaustion...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw occurs during the handling of SMB2LOGOFF commands. The issue arises from the lack of proper validation of a pointer before accessing it. An attacker can exploit this...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: ipc: Fix for use-after-free in ipcmsgsendrequest The ipcmsgsendrequest function waits for a generic netlink reply using an ipcmsgtableentry on the stack. The generic netlink handler handlegenericevent/handleresponse fil...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed the warning from kernelwriteiter 2110.972290 ------------ Cut here ------------ 2110.972301 WARNING: CPU: 3 PID: 735 at fs/readwrite.c:599 kernelwriteiter+0x21b/0x280 This patch does not allow writing to directories...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a slab out-of-bounds write in smbinheritdacl. The slab out-of-bounds write occurs because the offsets are larger than the allocation size of pntsd. This patch adds a check to validate the three offsets using the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures that sensitive crypto data is cleared before it is freed...