windows-smb-vulnerability-framework-cve-2025-33073

Windows SMB 客户端漏洞研究框架 作者： cyberseallll 创建时间： 2025 概述 我开发了这个研究框架，用于分析和理解 CVE-2025-33073，这是一个严重的 Windows SMB 客户端权限提升漏洞。该实现为漏洞研究和受控测试环境提供了全面的工具。 漏洞详情 CVE-2025-33073 是一个可通过网络访问的权限提升漏洞，影响 Windows SMB 客户端实现。该漏洞源于 SMB 协议栈中不正确的访问控制机制。 技术规格 CVSS 评分 ：8.8（高危） 漏洞类型 ：CWE-284（访问控制不当） 攻击向量 ：网络 影响 ：权限提升 用户交互 ：无...

Blackash-CVE-2025-33073

✨ CVE-2025-33073: Windows SMB 远程代码执行漏洞 🚨 🔥 高危：经身份验证的远程代码执行 🔥 Windows SMB 客户端中的访问控制不当 CWE-284 🛡️ 核心信息一览 方面| 详细信息 ---|--- CVSS v3.1 评分| 8.8（高危） 🔥 受影响系统| Windows 10, 11, Server 2012–2025（所有版本） 💻 披露日期| 2025年6月10日 📅（已在 2025年6月补丁星期二 中修复） 利用情况| 已在野外被积极利用 😱 于 2025年10月21日 加入 CISA KEV 攻击向量| 网络（已认证） 🌐 影响|...

Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (crxsa-2023_7749)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crxsa-20237749 advisory. kernel: use-after-free vulnerability in the smb client component CVE-2023-5345 kernel: IGB driver inadequate buffer size for frames larger than MTU...

Rocky Linux 8 [CIQ] Security Update: kernel-rt-debug-debuginfo / kernel-rt-debuginfo / etc (crlsa-2026_23259)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202623259 advisory. kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions CVE-2026-46243 Tenable has extracted the preceding description block directly from the...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_0793)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260793 advisory. kernel: drm/xe: Make dma-fences compliant with the safe access rules CVE-2025-38703 kernel: smb: client: let recvdone verify dataoffset, datalength and...

CVE-2026-90125

A flaw was found in the SMB client of the Linux kernel. In the smb2newreadreq function, a request buffer is allocated but not properly released when certain error conditions occur during an asynchronous read operation. A remote attacker could repeatedly trigger these error conditions, leading to ...

cifswitch-check

cifswitch-check 一个用于检查 Linux 系统是否暴露于 CIFSwitch CVE-2026-46243 的 Shell 脚本——这是一个自 2007 年以来一直存在于 Linux 内核 CIFS/SMB 客户端中的本地权限提升漏洞。 可在裸机主机、虚拟机以及容器内运行。设计用于直接嵌入 CI/CD 管道。 背景 CIFSwitch 于 2026 年 5 月 28 日由安全研究员 Asim Manizada 披露。该漏洞将内核 cifs.spnego 密钥类型中缺失的输入验证与 cifs-utils 中拥有 root 权限的 cifs.upcall 辅助程序串联起来。...

CVE-2025-33073

CVE-2025-33073 — Windows SMB 客户端 NTLM 反射权限提升 由 Sentinel AI Defense 撰写的研究报告。仅限防御性分析——此处不发布任何可用的利用代码或 PoC。 Windows SMB 客户端中存在一个不当的访问控制缺陷，它使原本被认为已缓解的 NTLM 反射技术重新复活——攻击者可借此诱使主机将高权限身份验证上下文反射回自身，并提升至 NT AUTHORITY\SYSTEM 权限。 📄 完整报告：https://sentinelaidefense.com/posts/cve-2025-33073-smb-reflection.html 概...

CVE-2026-97565

A flaw was found in the Linux kernel's SMB Server Message Block client. When communicating with a malicious or compromised server, the client fails to verify that an incoming read response meets the expected minimum header size before accessing header fields. A malicious server can send a truncat...

CVE-2026-97564

A flaw was found in the Linux kernel's SMB Server Message Block client. This vulnerability allows a local user to achieve privilege escalation due to missing validation on identity mapping key descriptions. Because the kernel does not verify that identity mapping requests originate internally, a...

CVE-2026-97563

A flaw was found in the Linux kernel's Server Message Block SMB client. When processing SMB version 1 responses, the read handler does not properly validate the data offset value sent by the server. A malicious or compromised SMB server can exploit this flaw by returning a crafted response with a...

CVE-2026-97562

A flaw was found in the Linux kernel's SMB Server Message Block client. A race condition occurs when a Distributed File System DFS automount expires while the client processes active filesystem references, resulting in a use-after-free memory flaw. A local user could exploit this timing issue...

CVE-2026-97561

A flaw was found in the Linux kernel's Server Message Block SMB client. When an administrator mounts a remote share with options configured to force specific local user and group ownership, the client fails to enforce these restrictions and instead accepts ownership values provided by the remote...

CVE-2026-97560

A flaw was found in the Linux kernel's SMB Server Message Block client. When parsing a share-root relative native symbolic link, an incorrect length calculation causes the client to read past the end of the allocated buffer in the smb2parsenativesymlink function. A malicious server or attacker...

CVE-2026-97559

A flaw was found in the Linux kernel's SMB client. An integer overflow during Discretionary Access Control List DACL reconstruction can allow a local user to corrupt file access permissions sent to a remote server. When processing file permission or ownership updates with numerous access control...

CVE-2026-97558

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem, which can lead to a Denial of Service DoS. Due to a timing issue during deferred file close operations, the kernel fails to properly release an internal file reference count when background cleanup work is already...

CVE-2026-97557

A flaw was found in the Linux kernel's Server Message Block SMB client. This flaw allows a remote or slow-responding SMB server to cause a Denial of Service DoS through a kernel crash. When handling opportunistic lock oplock break requests, the client can leak file reference counters if a new...

CVE-2026-97556

A flaw was found in the Linux kernel's SMB client. This vulnerability can lead to a denial of service DoS on systems using multi-user CIFS mount configurations. When processing an opportunistic lock oplock break, an error during tree link lookup prevents the client from releasing an acquired file...

CVE-2026-97555

A flaw was found in the Linux kernel's SMB client. When rewriting a Discretionary Access Control List DACL during file ownership updates, the kernel allocates memory based on the original identifier lengths rather than accounting for larger replacement Security Identifiers SIDs. A local user can...

CVE-2026-97554

A flaw was found in the Linux kernel's Server Message Block SMB client. When handling malformed directory entries with invalid security identifiers, the client fails to verify whether data parsing succeeded before processing file attributes. A malicious or compromised server could exploit this...