Ommaviy pochta ro'yxatlarida yadro tuzatishlaridan oldin e'lon qilingan CVSS 9.0 Linux KSMBD RCE zaifliklari

KSMBD, yadro ichidagi SMB serverini ishlatayotgan Linux serverlari, Trend Micro Zero Day Initiative tomonidan 9.0 ball bilan baholangan va asosiy yadroda hali tuzatilmagan, ommaviy e'lon qilingan ikkita masofadan kod bajarish zaifliklariga duchor bo'lmoqda.

Ulardan biri, ZDI-CAN-33774, har qanday tarmoq autentifikatsiyasidan oldin ishga tushirilishi mumkin. Boshqasi, ZDI-CAN-33549, SMB Direct transporti va RDMA-ga mos tarmoq interfeysini talab qiladi.

ZDI-CAN-33549 — KSMBD SMB Direct yo'lidagi butun son pastga tushishi (integer underflow). Mijoz RDMA bufer deskriptorlarini taqdim etishi mumkin, bunda birinchisi e'lon qilingan yuklamadan uzunroq bo'lib, serverning o'lcham hisoblagichi o'ralib qoladi va keyingi xotira nusxasi ajratilgan bufer oxiridan oshib ketishiga imkon beradi.

Bu uchta narsani talab qiladi: RDMA-ga mos interfeys (apparat yoki rxe dasturiy drayveri), yoziladigan KSMBD ulushi va SMB Direct-ni muzokara qiladigan mijoz.

ZDI-CAN-33774 hech qanday autentifikatsiyani talab qilmaydi va 445-portda KSMBD ishlatayotgan har qanday serverni ochib qo'yadi. Zaiflik KSMBD ishlov beruvchilar jadvalini tayinlash usulidagi poyga (race) bilan bog'liq: bir xil TCP yozuvida qisqa SMB1 paketlari to'plami va keyin SMB2 paketi yuborilganda, ishchilar SMB1 ma'lumotlarini SMB2 ishlov beruvchisi bilan qayta ishlaydi va qisqaroq bufer oxiridan o'qib ketadi. Hujumchi ulushga kirish huquqiga ega bo'lgach, buferdan yozib o'tish yo'li ham mavjud.

Payshanba kuni holatiga ko'ra, ikkala zaiflik ham asosiy yadroda yoki linux-next, uni oziqlantiradigan integratsiya daraxtida, nomlangan tuzatishga ega emas edi. Linux yangiliklar sayti Phoronix ma'lumotiga ko'ra, SMB Direct saqlovchisi Stefan Metzmacher ZDI-CAN-33549 uchun tuzatishni keyingi yadro rivojlanish sikliga mo'ljallab yuborgan, ammo bu boshqa joyda tasdiqlanmagan.

Asosiy yadroga tuzatishlar odatda barqaror tarmoqlarga va tarqatish yadrolariga yetib borishi uchun haftalar talab qiladi. Ikkala zaiflik ham CVE identifikatoriga ega emas, chunki yadro loyihasi ularni faqat barqaror tarmoq tuzatishi mavjud bo'lgandan keyin tayinlaydi.

systemctl status ksmbd yoki lsmod | grep ksmbd buyrug'ini ishga tushirish modul faol yoki yo'qligini tasdiqlaydi. Red Hat Enterprise Linux KSMBD-ni sukut bo'yicha o'z ichiga olmaydi, Red Hat qo'llab-quvvatlash hujjatlariga ko'ra.

ZDI hisobotlari topuvchi sifatida TrendAI, Trend Micro AI skanerini ko'rsatadi. Linux yadrosining xavfsizlik hujjatlari, 2026-yil may oyida Linus Torvalds yo'riqnomasi asosida yangilangan, AI vositalari tomonidan topilgan xatolar, ta'rifga ko'ra, allaqachon ommaviy va quyi tizim ishlab chiquvchilar ro'yxatlariga yuborilishi kerakligini ta'kidlaydi.

ZDI yo'naltirishi shu mantiqqa amal qilganga o'xshaydi, xususiy yadro xavfsizlik manziliga qo'shimcha ravishda ommaviy pochta ro'yxatlarini nusxalab, hisobotlarga hech qanday yamoq (patch) ilova qilmagan.

Barqaror yadro saqlovchisi Greg Kroah-Hartman beshta yadro hisobotining uchtasiga bir necha daqiqa ichida javob berdi. VMware GPU drayveri haqidagi hisobotga u shunday yozdi: "Nima uchundir siz buni ommaviy ro'yxatlarga yubordingiz va yamoq ilova qilmadingiz, shuning uchun biz bu bilan hech narsa qila olmaymiz." NVMe drayveri haqidagi hisobotga, o'n yetti soniya keyin: "Yana, yamoq yo'q va ommaviy ro'yxatga yuborilganmi? Iltimos, yuborish jarayoningizni tuzating."

Besh yadro hisobotining uchtasi SMB bilan bog'liq emas. ZDI-CAN-33367, tadqiqotchi p1r0x tomonidan topilgan, yadro tarmoq stekidagi mahalliy imtiyoz oshirish zaifligi bo'lib, mahalliy kirishni talab qiladi. ZDI-CAN-34068 VMware virtual GPU drayveridagi mahalliy imtiyoz oshirish, ZDI-CAN-34076 NVMe maqsad drayveridagi axborot oshkor qilish zaifligi va ularning hech biri KSMBD serverlariga ta'sir qilmaydi.

Oltinchi ZDI hisoboti, ZDI-CAN-32005, Linux yadrosidan alohida tarmoq demoni ConnMan'dagi bufer to'lib ketishi (buffer overflow).

Yangilanish: ZDI-CAN-33367 uchun ommaviy ekspluat asosiy tarqatishlarda root huquqini oladi

ZDI-CAN-33367, besh yadro hisobotining eng past baholangan zaifligi, root huquqiga erishish uchun ko'rsatilgan ommaviy ekspluat kodiga ega yagona hisobot. Hisobot manba kodi bilan birga ommaviy ro'yxatlarga joylashtirilgan, AlmaLinux ma'lumotiga ko'ra, va CloudLinux o'z yadro jamoasi bu kodni AlmaLinux 8, 9 va 10, CloudLinux 9 va 10, Debian 12 va 13, Ubuntu 24.04 va 26.04 da root olish uchun ishlatganini aytdi. CentOS 6 va 7 yadrolari ta'sirlanmagan.

Zaiflik oddiy mahalliy foydalanuvchiga faqat o'qish huquqiga ega bo'lgan fayllarning yadro xotirasidagi nusxasini o'zgartirishga imkon beradi, masalan setuid dasturlari yoki /etc/passwd, bu esa mashinani egallash uchun yetarli. Bu skb_zerocopy() yadro IPsec kodiga umumiy xotira sahifalarini joyida shifrlamaslikni aytadigan belgini tushirib yuborishi tufayli ishlaydi. Bu belgi bu yilgi Dirty Frag (CVE-2026-43284) tuzatishi bilan qo'shilgan, shuning uchun bu tuzatishni o'z ichiga olgan yadrolar hali ham ochiq, CloudLinux aytdi.

Ekspluat imtiyozsiz foydalanuvchi nom maydonlarini (unprivileged user namespaces) talab qiladi, bu oddiy hisobga o'z shaxsiy tarmoq sozlamasining ma'muri sifatida harakat qilishga imkon beradi, va ta'sirlangan yadrolar jo'natadigan tarmoq modullari to'plamini. AlmaLinux bunday nom maydonlarini sukut bo'yicha ruxsat etadi. Ubuntu'ning AppArmor cheklovi ularni to'xtatmadi, Sysdig xabar berdi.

Zizhen Liu tomonidan yozilgan va netdev saqlovchisi Eric Dumazet tomonidan ko'rib chiqilgan yuqori oqim tuzatishi 22-oktabrda joylashtirildi. CloudLinux ma'lumotiga ko'ra, 23-oktabr, juma kuni 14:59 UTC holatiga ko'ra u hali birlashtirilmagan edi, va Sysdig shanba kuni u hali birlashtirilmaganligini va oltita hisobotning hech biri CVE ga ega emasligini xabar qildi. AlmaLinux Red Hat yangilanishidan oldin tuzatishni orqaga ko'chirdi va AlmaLinux 8, 9 va 10 uchun tuzatilgan yadrolarni juma kuni sinov omboriga joylashtirdi. CloudLinux o'sha kuni CloudLinux 10 va AlmaLinux 10 uchun qayta yuklamasdan qo'llaniladigan KernelCare jonli yamoqni (live patch) chiqardi, CloudLinux 9 ko'rib chiqilmoqda va CloudLinux 8 ishlanmoqda.

Tuzatilgan yadrolar kelguncha, CloudLinux va Sysdig imtiyozsiz foydalanuvchi nom maydonlarini talab qilmaydigan xostlarda user.max_user_namespaces ni 0 ga o'rnatishni maslahat beradi. Sozlama qayta yuklamasdan qo'llaniladi, ammo oddiy hisoblar uchun rootless konteynerlar, Flatpak va ba'zi brauzer qum qutilari (sandbox) ishlashini to'xtatadi, va CloudLinux bu sozlamani ekspluatga qarshi hali sinovdan o'tkazmaganini aytdi. sysctl user.max_user_namespaces buyrug'i 0 qaytarsa, yo'l yopilgan. AlmaLinux IPsec ishlatmaydigan tizimlarda to'xtash chorasi sifatida esp4 va esp6 yadro modullarini bloklashni tavsiya qiladi. Sysdig shanba kuni yovvoyi tabiatda ekspluatatsiya haqida hech qanday xabar berilmaganini aytdi.

Yangilanish: Saqlovchilar ikkala KSMBD zaifligi uchun mavjud tuzatishlarga ishora qilmoqda

KSMBD saqlovchisi Namjae Jeon ZDI-CAN-33774 mavzusida poyga 30-sentabrda yozgan va boshqa hisobotchiga tegishli bo'lgan 68f410faedaf commit bilan allaqachon tuzatilganini aytdi. Commit uning ksmbd-for-next tarmog'ida joylashgan va shanba kuni holatiga ko'ra chiqarilgan yadroga yetib bormagan, Sysdig xabar berdi. ZDI-CAN-33549 uchun Metzmacher 21-oktabrda hisobotchidan Linux 7.5 uchun o'z tarmog'ini sinovdan o'tkazishni so'radi va zaiflik u yerda allaqachon tuzatilgan deb hisoblaydi. Bu shanba kuni holatiga ko'ra tasdiqlanmagan.

Ikkala KSMBD zaifligi uchun ommaviy isbot-kod (proof-of-concept) yadro xotira sizib chiqishi va ishdan chiqishlarni ko'rsatadi, kod bajarishni emas, CloudLinux va Sysdig ma'lumotiga ko'ra. ZDI-CAN-33774 kodi autentifikatsiyadan oldin har bir urinishda 28 bayt yadro uyum xotirasini sizdiradi va yadroni ishdan chiqarishi mumkin. ZDI hisoboti buferdan yozib o'tish yo'lini ham tasvirlaydi, ammo ommaviy hech narsa uni kod bajarishga olib kelishini ko'rsatmaydi, Sysdig aytdi. KSMBD AlmaLinux va CloudLinux 9 va 10 yadrolariga o'rnatilmagan, Debian va Ubuntu'da esa faqat ma'mur ksmbd-tools ni o'rnatib, xizmatni ishga tushirgandan keyin ishlaydi, CloudLinux aytdi.

(Maqola 2026-yil 26-oktabrda nashr etilgandan keyin ZDI-CAN-33367 uchun ommaviy ekspluat va ikkala KSMBD zaifligi uchun saqlovchilarning tuzatish holatini o'z ichiga olish uchun yangilandi.)

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.

One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface.

ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path. A client can supply RDMA buffer descriptors in which the first is longer than the declared payload, causing the server's size counter to wrap and allowing a subsequent memory copy to overrun the end of an allocated buffer.

It requires three things: an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct.

ZDI-CAN-33774 requires no authentication, exposing any server running KSMBD on port 445. The flaw is a race in how KSMBD assigns its handler table: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to handle SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A path to writing past the buffer also exists once an attacker has access to a share.

As of Thursday, neither flaw had a named fix in the mainline kernel or in linux-next, the integration tree that feeds it. Linux news site Phoronix said SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle, but this had not been confirmed elsewhere.

Fixes to mainline typically take weeks to reach stable branches and distribution kernels after that. Neither flaw has a CVE identifier, since the kernel project assigns those only after a stable-tree fix is available.

Running systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.

The ZDI reports credit TrendAI, Trend Micro's AI scanner, as the finder. The Linux kernel's security documentation, updated in May 2026 following guidance from Linus Torvalds, states that bugs found by AI tools are, by definition, already public and should be sent to subsystem developer lists.

ZDI's routing appeared to follow that logic, copying public mailing lists alongside the private kernel security address without attaching patches to any of the reports.

Stable-kernel maintainer Greg Kroah-Hartman replied to three of the five kernel reports within minutes of each other. To the report on the VMware GPU driver, he wrote: "For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this." On the NVMe driver report, seventeen seconds later: "Again, no patch, and sent to a public list? Please fix your submission process."

Three of the five kernel reports are not related to SMB. ZDI-CAN-33367, discovered by researcher p1r0x, is a local privilege escalation in the kernel's networking stack that requires local access. ZDI-CAN-34068 is a local privilege escalation in the VMware virtual GPU driver, ZDI-CAN-34076 is an information disclosure in the NVMe target driver, and neither affects KSMBD servers.

A sixth ZDI report, ZDI-CAN-32005, is a buffer overflow in ConnMan, a network daemon separate from the Linux kernel.

Update: Public Exploit for ZDI-CAN-33367 Gains Root on Major Distributions

ZDI-CAN-33367, the lowest-rated of the five kernel reports, is the only one with public exploit code shown to reach root. The report was posted to the public lists together with the source code of a working proof-of-concept, according to AlmaLinux, and CloudLinux said its kernel team used that code to get root on AlmaLinux 8, 9 and 10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04. CentOS 6 and 7 kernels are not affected.

The flaw lets an ordinary local user change the kernel's in-memory copy of files they are only allowed to read, such as setuid programs or /etc/passwd, which is enough to take over the machine. It works because skb_zerocopy() drops a marker that tells the kernel's IPsec code not to decrypt shared memory pages in place. That marker was added by this year's fix for Dirty Frag (CVE-2026-43284), so kernels carrying that fix are still exposed, CloudLinux said.

The exploit needs unprivileged user namespaces, which let an ordinary account act as administrator of its own private network setup, and a set of networking modules that affected kernels ship. AlmaLinux allows such namespaces by default. Ubuntu's AppArmor restriction on them did not stop the exploit, Sysdig reported.

An upstream fix written by Zizhen Liu and reviewed by netdev maintainer Eric Dumazet was posted on October 22. It had not been merged as of 14:59 UTC on Friday, October 23, according to CloudLinux, and Sysdig reported on Saturday that it was still unmerged and that none of the six reports had a CVE. AlmaLinux backported the fix ahead of a Red Hat update and placed patched kernels for AlmaLinux 8, 9 and 10 in its testing repository on Friday. CloudLinux released a KernelCare live patch, which applies without a reboot, for CloudLinux 10 and AlmaLinux 10 the same day, with CloudLinux 9 in review and CloudLinux 8 in progress.

Until fixed kernels arrive, CloudLinux and Sysdig advise setting user.maxusernamespaces to 0 on hosts that do not need unprivileged user namespaces. The setting applies without a reboot but stops rootless containers, Flatpak and some browser sandboxes from working for ordinary accounts, and CloudLinux said it had not yet tested the setting against the exploit. Running sysctl user.maxusernamespaces prints 0 when the path is closed. AlmaLinux recommends blocking the esp4 and esp6 kernel modules as a stopgap on systems that do not use IPsec. Sysdig said on Saturday that no exploitation in the wild had been reported.

Update: Maintainers Point to Existing Fixes for Both KSMBD Flaws

KSMBD maintainer Namjae Jeon replied on the ZDI-CAN-33774 thread that the race is already fixed by commit 68f410faedaf, which he wrote on September 30 and credited to a different reporter. The commit sits in his ksmbd-for-next branch and had not reached a released kernel as of Saturday, Sysdig reported. For ZDI-CAN-33549, Metzmacher asked the reporter on October 21 to test his branch for Linux 7.5, saying he believes the flaw is already fixed there. That had not been confirmed as of Saturday.

The public proof-of-concept code for the two KSMBD flaws shows a kernel memory leak and crashes, not code execution, according to CloudLinux and Sysdig. The ZDI-CAN-33774 code leaks 28 bytes of kernel heap memory per attempt before authentication and can crash the kernel. ZDI's report also describes a path to writing past the buffer, but nothing public shows it leading to code execution, Sysdig said. KSMBD is not built into the AlmaLinux and CloudLinux 9 and 10 kernels, and on Debian and Ubuntu it runs only after an administrator installs ksmbd-tools and starts the service, CloudLinux said.

(The story was updated after publication on October 26, 2026, to include the public exploit for ZDI-CAN-33367 and the maintainers' fix status for the two KSMBD flaws.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.