Technology newsroom
URGENT ALERT! 🚨 Critical RCE Vulnerability (CVSS 9.0) in Linux KSMBD Disclosed Publicly Before Patch
ZDI researchers have disclosed two critical RCE vulnerabilities (CVSS 9.0) in the Linux KSMBD module, which were made public before an official patch, placing servers at high risk of remote attacks.
Key Highlights:
- Two critical Remote Code Execution (RCE) vulnerabilities discovered in the Linux Kernel's KSMBD module.
- The vulnerabilities are rated CVSS 9.0 and were publicly disclosed before official patches were released.
- One vulnerability (ZDI-CAN-33774) is pre-authentication, significantly increasing the risk.
Researchers from Trend Micro's Zero Day Initiative (ZDI) have revealed details of two critical security vulnerabilities affecting KSMBD, an SMB Server module running directly on the Linux Kernel. This disclosure has caused significant concern among system administrators, as the vulnerability details were publicly published on mailing lists before official patches were available in the Mainline Kernel.
Vulnerability One: ZDI-CAN-33774
This vulnerability is a Remote Code Execution (RCE) of the highest danger, classified as pre-authentication. This means an attacker within the same network can immediately execute malicious code on the target server without any authentication. This places Linux servers with KSMBD enabled at high risk of easy system compromise.
Vulnerability Two: ZDI-CAN-33549
This second RCE vulnerability, while equally severe, has more complex attack conditions. An attacker can exploit this vulnerability only if the server is configured to use SMB Direct transport and operates on an RDMA (Remote Direct Memory Access)-supported network, typically found in high-performance environments. Despite these specific conditions, organizations using such configurations remain at high risk.
The public disclosure of technical details for these CVSS 9.0 vulnerabilities before official patches creates a zero-day risk for system administrators. It is currently recommended that KSMBD users closely monitor patch updates from their respective Linux Distributions and consider temporarily disabling KSMBD if not essential, to mitigate the risk of attack.
Do your systems utilize KSMBD? How do you plan to address vulnerabilities of this nature?