KSMBDrain

अवलोकन KSMBDrain CVE-2025-38501 के लिए प्रूफ-ऑफ-कॉन्सेप्ट शोषण। यह दूरस्थ रूप से KSMBD सर्वर की कनेक्शन सीमा को समाप्त कर सकता है। विवरण एक दूरस्थ हमलावर TCP 3-वे हैंडशेक करके और फिर आगे के पैकेटों का जवाब न देकर KSMBD सर्वर की अधिकतम कनेक्शन सीमा को समाप्त कर सकता है। डिफ़ॉल्ट रूप से, KSMBD सर्व...

KSMBD-CVE-2025-37947

CVE-2025-37947 PoC لـ ksmbd لمزيد من المعلومات، راجع المقالة هنا. الملفات bpf-tracer.sh - متتبع msgmsg الخاص بـ BPF CVE-2025-37947.c - استغلال لـ CVE-2025-37947 proof-of-concept.c - مشغّل بسيط يسبب الكتابة خارج الحدود OOB write ksmbd.conf - إعدادات ksmbd Makefile - يبني الاستغلال run-qemu.sh...

CVE-2025-38561

CVE-2025-38561 ksmbd: состояние гонки PreauhHashValue Если клиент отправляет несколько запросов на установку сеанса в ksmbd, может возникнуть состояние гонки PreauhHashValue...

ksmbrace

ksmbrace بحثٌ في الثغرات ضمن ksmbd ، خادم SMB3 المدمج في نواة لينكس fs/smb/server/. ثغرات من هجوم مُصادَق عليه في مسارَي المقبض الدائم durable-handle وتبيان المسار path-resolution في ksmbd. يشير الاسم إلى ثيمة سباق التوقيت race condition التي تميّز هذا الخط من العمل انظر ثغرة UAF المحتجَزة في قفل...

SMB-LINUX-CVE-2025-37899

लिनक्स कर्नेल के ksmbd में Use-After-Free भेद्यता CVE-2025-37899 विवरण लिनक्स कर्नेल के ksmbd मॉड्यूल में एक use-after-free प्रकार की भेद्यता खोजी गई है, जो नेटवर्क पर फ़ाइल साझाकरण के लिए SMB सर्वर मैसेज ब्लॉक प्रोटोकॉल के कार्यान्वयन के लिए जिम्मेदार है। यह भेद्यता, जिसे CVE-2025-37899 के रूप म...

ksmbd-n-day

README यह रिपॉजिटरी मेरे शोध लेख Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days के साथ आती है, जिसमें मैं 2023 के n-दिनों के लिए एक POC विकसित करता हूँ: CVE-2023-52440 और CVE-2023-4130। मैं कर्नेल .config, एक कर्नेल रन स्क्रिप्ट, एक इमेज बिल्ड स्क्रिप्ट और POC प्रदान...

LSN-0121-1: Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipcmsgsendrequest ipcmsgsendrequest waits for a generic netlink reply using an ipcmsgtableentry on the stack. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix...

LSN-0121-1 Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipcmsgsendrequest ipcmsgsendrequest waits for a generic netlink reply using an ipcmsgtableentry on the stack. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix...

SUSE CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: fixed a possible memory leak in smb2lock. argv needs to be freed when setupasyncwork fails, or when the current process is awakened...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel. A memory leak may occur if a client sends a session setup request with an unknown NTLMSSP message type, potentially leading to resource exhaustion...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

A flaw was discovered in the handling of SMB2 read requests within the kernel’s ksmbd module. The issue arises due to the lack of proper validation of user-provided data, which can lead to reading data beyond the end of an allocated buffer. An attacker can exploit this vulnerability to disclose...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: fixed the global out-of-bounds read in ksmbdnlpolicy. Similar to the reported issue see commit b33fb5b801c6 “net: qualcomm: rmnet: fixed global out-of-bounds in rmnetpolicy”, my local fuzzer discovered another global...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw occurs during the handling of SMB2LOGOFF commands. The issue arises from the lack of proper validation of a pointer before accessing it. An attacker can exploit this...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Validates the session ID and tree ID in compound requests. The function smb2getmsg in smb2getksmbdtcon and smb2checkusersession always returns the first command in a compound request’s headers. If SMB2TREECONNECTHE is the...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw resides in the handling of SMB2SESSIONSETUP commands. The problem arises due to a lack of control over resource consumption. An attacker can exploit this vulnerability to...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel. A deadlock occurs when multiple session setup requests are sent simultaneously, which may lead to a denial of service...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a potential out-of-bounds write issue in getfileallinfo for compound requests. When a compound request consists of QUERYDIRECTORY + QUERYINFO FILEALLINFORMATION, and the first command consumes nearly the entire...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a slab out-of-bounds write in smbinheritdacl. The slab out-of-bounds write occurs because the offsets are larger than the allocation size of pntsd. This patch adds a check to validate the three offsets using the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed a slab-out-of-bounds issue in initsmb2rsphdr When smb1 mounting fails, KASAN detects a slab-out-of-bounds issue in initsmb2rsphdr, as follows. For smb1’s negotiate56 bytes, initsmb2rsphdr is called for smb2. The issu...