Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Read original article ↗AI Summary
Two critical remote code execution vulnerabilities (CVSS 9.0) in the Linux kernel's built-in KSMBD SMB server have been publicly disclosed via mailing lists before official fixes were available. The first, ZDI-CAN-33774, allows unauthenticated attackers to trigger a race condition in the protocol dispatch handler by sending a burst of SMB1 packets followed by an SMB2 packet, leading to out-of-bounds reads and potential code execution. The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path that can be exploited when an RDMA-capable interface and writable share are present, allowing memory corruption. Neither vulnerability has a patch in the mainline kernel or a CVE identifier yet, increasing the risk of exploitation in exposed systems running KSMBD on port 445.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.