The ksmbd module, which provides a built-in Linux kernel implementation of a file server based on the SMB protocol, has 14 identified vulnerabilities, four of which allow remote code execution with kernel privileges. An attack can be carried out without authentication, as long as the ksmbd module is activated on the system. The issues manifest starting from kernel 5.15, in which the ksmbd module was included. Vulnerabilities have been fixed in kernel updates 6.3.2, 6.2.15, 6.1.28, and 5.15.112. You can track the fixes in distributions on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Gentoo, Arch.
Identified issues:
- CVE-2023-32254, CVE-2023-32250, CVE-2023-32257, CVE-2023-32258 — remote code execution with kernel privileges due to inadequate object locking when processing external requests containing SMB2_TREE_DISCONNECT, SMB2_SESSION_SETUP, SMB2_LOGOFF, and SMB2_CLOSE commands, which leads to an exploitable race condition. An attack can be executed without going through authentication.
- CVE-2023-32256 — kernel memory content leakage due to a race condition when processing SMB2_QUERY_INFO and SMB2_LOGOFF commands. An attack can be executed without going through authentication.
- CVE-2023-32252, CVE-2023-32248 — remote denial of service due to null pointer dereference when processing SMB2_LOGOFF, SMB2_TREE_CONNECT, and SMB2_QUERY_INFO commands. An attack can be executed without going through authentication.
- CVE-2023-32249 — session hijacking possible due to lack of proper isolation when processing session identifiers in multi-channel mode.
- CVE-2023-32247, CVE-2023-32255 — denial of service due to memory leakage when processing the SMB2_SESSION_SETUP command. An attack can be executed without going through authentication.
- CVE-2023-2593 — denial of service due to memory exhaustion caused by an error that prevents memory from being returned when processing new TCP connections. An attack can be executed without going through authentication.
- CVE-2023-32253 — denial of service due to deadlock when processing the SMB2_SESSION_SETUP command. An attack can be executed without going through authentication.
- CVE-2023-32251 — lack of protection against authentication parameter enumeration attacks (brute force).
- CVE-2023-32246 — a local user with permission to unload the ksmbd module can execute their code at the kernel level of Linux.
Additionally, 5 vulnerabilities have been identified in the ksmbd-tools package, which includes utilities for managing and working with ksmbd, running in user space. The most critical vulnerabilities (ZDI-CAN-17822, ZDI-CAN-17770, ZDI-CAN-17820, CVE not yet assigned) allow a remote unauthenticated attacker to execute their code with root privileges. These vulnerabilities are caused by the lack of size checking for incoming external data before copying it into the buffer within the WKSSVC service code and within the LSARPC_OPNUM_LOOKUP_SID2 and SAMR_OPNUM_QUERY_USER_INFO opcode handlers. Two more vulnerabilities (ZDI-CAN-17823, ZDI-CAN-17821) could lead to remote denial of service without authentication.
Ksmbd is presented as a high-performance and ready-to-use extension to Samba for embedded devices, integrable with Samba tools and libraries when necessary. Support for running an SMB server using the ksmbd module has been included in the Samba package since version 4.16.0. Unlike the SMB server that operates in user space, ksmbd is more efficient in terms of performance, memory consumption, and integration with advanced kernel features. The authors of ksmbd code are Namjae Jeon from Samsung and Hyunchul Lee from LG, while maintenance within the kernel is handled by Steve French from Microsoft, the maintainer of the CIFS/SMB2/SMB3 subsystems in the Linux kernel and a long-time contributor to the Samba development team, who has made significant contributions to the implementation of SMB/CIFS protocol support in Samba and Linux.
Additionally, two vulnerabilities in the vmwgfx graphics driver, used for 3D acceleration in VMware environments, can be noted. The first vulnerability (ZDI-CAN-20292) allows a local user to escalate their privileges in the system. This vulnerability is due to the lack of buffer state checks before freeing it when processing the vmw_buffer_object object, which can lead to double free calls. The second vulnerability (ZDI-CAN-20110) results in a leak of kernel memory contents due to errors in locking GEM objects.
Source: opennet.ru
