Linux kernel ksmbd SMB server faces critical vulnerabilities

The Linux kernel's integrated SMB server, ksmbd, is affected by multiple critical security vulnerabilities that could allow remote code execution or unauthorized data access. The Zero Day Initiative (ZDI) from Trend Micro has assigned both major flaws a CVSS score of 9.0.

One vulnerability, ZDI-CAN-33774, allows for unauthenticated remote code execution. This flaw stems from a race condition during handler table allocation; an attacker sending specific SMB1 and SMB2 packets in a single TCP transmission can cause the server to process data using the wrong handler, leading to a buffer overflow. This affects any server where ksmbd is accessible via port 445.

A second vulnerability, ZDI-CAN-33549, involves an integer underflow within the SMB Direct transport path. Exploiting this requires an RDMA-capable network card or the rxe software driver, along with a writable share.

These vulnerabilities were identified by Trend Micro’s TrendAI scanner. As of late October, no patches were available in the main kernel branch or the linux-next integration branch, though a fix for the integer underflow has been submitted for the next development cycle.