CVSS score 9.6, Linux Kernel exposed "critical" SMB vulnerability of remotely executable code

CTOnews.com, December 26 (Xinhua)-- Security experts have discovered a "critical" vulnerability in Linux Kernel (CVSS score 9.6) that allows hackers to attack SMB servers and execute arbitrary code remotely. This vulnerability mainly occurs on SMB servers with ksmbd enabled.

CTOnews.com learned that KSMBD is a Linux kernel server that implements the SMB3 protocol in kernel space and is used to share files over a network. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code.

"this vulnerability allows remote attackers to execute arbitrary code on the affected Linux Kernel installation," ZDI said in an announcement. As long as the system is enabled with ksmbd, it is vulnerable to hackers, and this vulnerability does not require user / manager authentication. A more detailed explanation is that the vulnerability lies in the processing of SMB2_TREE_DISCONNECT commands. This problem is due to the fact that the existence of an object is not verified before the operation is performed on it. An attacker can exploit this vulnerability to execute arbitrary code in the kernel.

The vulnerability was discovered by Thales Group Thalium team researchers Arnaud Gatignol, Quentin Minster, Florent Saudel, and Guillaume Teissier on July 26, 2022. The vulnerability was publicly disclosed on December 22, 2022.

CTOnews.com learned that the CVSS system rates all vulnerabilities on a scale from 0.0 to 10.0, where 10.0 represents the highest security risk. A score higher than or equal to 4. 0 indicates that it does not meet the PCI criteria. Low-risk vulnerabilities with scores of 0. 0 to 3. 9 in CVSS systems can only be exploited locally and require authentication.