{"id":125569,"date":"2025-05-25T15:05:07","date_gmt":"2025-05-25T13:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai"},"modified":"2025-05-25T15:05:07","modified_gmt":"2025-05-25T13:05:07","slug":"udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai","title":{"rendered":"Remote vulnerability in the ksmbd module of the Linux kernel identified using AI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been discovered in the ksmbd module, which provides a built-in Linux kernel implementation of a file server based on the SMB protocol (CVE-2025-37899). This vulnerability could potentially allow for code execution at the kernel level by sending specially crafted packets. Notably, the issue was identified during a code analysis conducted by the AI model from OpenAI o3. Since the full code of the ksmbd module exceeds the context size allowable for the model, the verification was performed in stages, focusing on the implementation code for individual SMB commands using typical requests. <\/p>\n
The vulnerability stems from accessing already freed memory (use-after-free) in the processing code of the SMB command 'logoff': the structure sess->user was being used in another thread when a session setup request associated with the freed session arrived through another connection. When processing such requests, the function smb2_sess_setup was executed, which accessed the already freed structure sess->user. <\/p>\n
The vulnerability has been fixed in updates 6.15-rc5, 6.14.6, 6.12.28, 6.6.90, and 6.1.138. In the 5.15 branch, which includes the ksmbd module, the issue does not manifest. The progress on addressing the vulnerability in distributions can be tracked on the following pages: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Arch. <\/p>\n
The problem was identified by Sean Heelan, the creator of the Prodfiler code profiling platform, specializing in optimization and security auditing of code. Sean aimed to evaluate how prepared modern AI models are for conducting security audits and concluded that the o3 model has significantly advanced in analyzing and understanding the structure, logic, and functionality of code. It is noted that to identify the vulnerability, the model was able to construct a reasoning chain that considered the possibility of parallel connections to server<\/a> and the use of data structures in various situations. <\/p>\n