Two vulnerabilities have been identified in the ksmbd module, which offers a kernel-level file server implementation based on the SMB protocol in Linux. These vulnerabilities allow remote code execution with kernel privileges without authentication or enable the determination of the kernel memory content on systems with the ksmbd module activated. The issues manifest starting from kernel version 5.15, which included the ksmbd module. The vulnerabilities have been fixed in kernel updates 6.7.2, 6.6.14, 6.1.75, and 5.15.145. Updates can be tracked in the following distributions: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.
The first vulnerability (CVE-2024-26592) can lead to the attacker's code being executed with kernel privileges when sending specially crafted unauthenticated TCP requests to server ksmbd. The vulnerability is caused by incorrect locking of objects in the TCP connection establishment and interruption code to ksmbd, allowing conditions for access to already freed memory (use-after-free).
The second vulnerability (CVE-2024-26594) leads to kernel memory content leakage when processing an invalid mech token in a session establishment request sent by the client. This vulnerability arises from improper handling of data with the SMB2 Mech token, resulting in reading data beyond the allocated buffer.
Additionally, several other vulnerabilities in the Linux kernel can be noted:
- CVE-2023-52439 — accessing already freed memory (use-after-free) in the uio_open function of the uio subsystem, potentially allowing a local user to execute their code with kernel privileges.
- CVE-2024-26582 — accessing already freed memory (use-after-free) in the TLS implementation at the kernel level (ktls), potentially allowing privilege escalation during decryption operations.
- CVE-2024-0646 — writing to memory beyond the buffer in the ktls subsystem when manipulating a ktls socket locally using the splice function. This vulnerability potentially allows privilege escalation in the system.
- CVE-2023-6932 — a race condition in the implementation of the IGMP (Internet Group Management Protocol) protocol in the IPv4 stack, leading to accessing already freed memory (use-after-free). This vulnerability potentially allows a local user to elevate their privileges in the system.
- CVE-2023-52435 — MSS overflow in the skb_segment() function of the kernel's network stack.
- CVE-2024-26601 — an error in the block release code in the ext4 FS can be exploited to corrupt the buddy bitmap.
- CVE-2024-26598 — a use-after-free vulnerability in the hypervisor. KVM.
Source: opennet.ru
