A vulnerability has been discovered in the ksmbd module, which provides a built-in Linux kernel implementation of a file server based on the SMB protocol (CVE-2025-37899). This vulnerability could potentially allow for code execution at the kernel level by sending specially crafted packets. Notably, the issue was identified during a code analysis conducted by the AI model from OpenAI o3. Since the full code of the ksmbd module exceeds the context size allowable for the model, the verification was performed in stages, focusing on the implementation code for individual SMB commands using typical requests.
The vulnerability is caused by accessing already freed memory (use-after-free) in the SMB command handling code for 'logoff': the structure sess->user was used in another thread if a session setup request was received for a releasing session from a different connection. During the handling of such requests, the function smb2_sess_setup was called, which accessed the already freed structure sess->user.
The vulnerability has been fixed in updates 6.15-rc5, 6.14.6, 6.12.28, 6.6.90, and 6.1.138. In the 5.15 branch, which includes the ksmbd module, the issue does not manifest. The progress on addressing the vulnerability in distributions can be tracked on the following pages: Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Arch.
The problem was identified by Sean Heelan, the creator of the Prodfiler code profiling platform, specializing in optimization and security auditing of code. Sean aimed to evaluate how prepared modern AI models are for conducting security audits and concluded that the o3 model has significantly advanced in analyzing and understanding the structure, logic, and functionality of code. It is noted that to identify the vulnerability, the model was able to construct a reasoning chain that considered the possibility of parallel connections to server and the use of data structures in various situations.
As a result, the model identified the problematic part of the code where the freed object remained accessible in another thread. The model discovered the issue itself based solely on a general query requesting a check for vulnerabilities in the code, with an emphasis on detecting dangling pointers and memory accesses after it has been freed, while eliminating false positives and hypothetical problems.
Before searching for new vulnerabilities, Shaun tested various models for the detection of CVE-2025-37778 vulnerability in ksmbd, which he had previously identified during a manual audit and which was fixed in the kernel update 6.15-rc3. The o3 model successfully completed the task and showed results closest to the manual audit, after which Shaun switched to experiments aimed at finding previously unknown vulnerabilities.
Source: opennet.ru
