{"id":125569,"date":"2025-05-25T15:05:07","date_gmt":"2025-05-25T13:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai"},"modified":"2025-05-25T15:05:07","modified_gmt":"2025-05-25T13:05:07","slug":"udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai","title":{"rendered":"Vulnerabiliteti i larg\u00ebt n\u00eb modul nga ksmbd i b\u00ebrtham\u00ebs Linux, i identifikuar me ndihm\u00ebn e AI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb modulin ksmbd, q\u00eb ofron nj\u00eb implementim t\u00eb integruar t\u00eb serverit t\u00eb skedar\u00ebve n\u00eb b\u00ebrtham\u00ebn Linux mbi baz\u00ebn e protokollit SMB, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2025-37899) q\u00eb potencialisht lejon ekzekutimin e kodit t\u00eb p\u00ebrdoruesit n\u00eb nivelin e b\u00ebrtham\u00ebs p\u00ebrmes d\u00ebrgimit t\u00eb paketave t\u00eb formuara posa\u00e7\u00ebrisht. Vlen t\u00eb theksohet se problemi u identifikua gjat\u00eb analiz\u00ebs s\u00eb kodit nga modeli AI i OpenAI, o3. Duke qen\u00eb se kodi i plot\u00eb i modulit ksmbd tejkalon madh\u00ebsin\u00eb e lejuar p\u00ebr modelin, verifikimi u krye n\u00eb etapa p\u00ebr kodin me implementimin e komandave t\u00eb ve\u00e7anta SMB, duke p\u00ebrdorur k\u00ebrkesa tipike. <\/p>\n
Vulnerabiliteti shkaktohet nga referimi n\u00eb kujtes\u00ebn e liruar tashm\u00eb (use-after-free) n\u00eb kodin e p\u00ebrpunimit t\u00eb komand\u00ebs SMB \"logoff\": struktura sess->user p\u00ebrdorej n\u00eb nj\u00eb thread tjet\u00ebr, n\u00ebse nj\u00eb k\u00ebrkes\u00eb p\u00ebr vendosjen e sesionit, e lidhur me sesionin e liruar, arrinte nga nj\u00eb lidhje tjet\u00ebr. Gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebtyre k\u00ebrkesave, funksioni smb2_sess_setup aktivizohej, i cili referohej n\u00eb struktur\u00ebn sess->user q\u00eb ishte liruar m\u00eb par\u00eb. <\/p>\n
Dob\u00ebsia \u00ebsht\u00eb zgjidhur n\u00eb p\u00ebrdit\u00ebsimet 6.15-rc5, 6.14.6, 6.12.28, 6.6.90, 6.1.138. N\u00eb deg\u00ebn 5.15, n\u00eb t\u00eb cil\u00ebn \u00ebsht\u00eb pranuar moduli ksmbd, problemi nuk manifestohet. Mund t\u00eb ndiqni eliminimin e dob\u00ebsis\u00eb n\u00eb shp\u00ebrndarjet e m\u00ebposhtme: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Arch. <\/p>\n
Problemin e identifikoi Sean Heelan, krijuesi i platform\u00ebs s\u00eb profilizimit t\u00eb kodit Prodfiler, q\u00eb specializohet n\u00eb optimizimin dhe auditetin e siguris\u00eb s\u00eb kodit. Sean vendosi t\u00eb vler\u00ebsoj\u00eb sa gati jan\u00eb modelet moderne t\u00eb AI p\u00ebr t\u00eb kryer audite sigurie dhe arriti n\u00eb p\u00ebrfundimin se modeli o3 ka b\u00ebr\u00eb p\u00ebrparime t\u00eb dukshme n\u00eb analiz\u00eb dhe kuptimin e struktur\u00ebs, logjik\u00ebs dhe funksionalitetit t\u00eb kodit. V\u00ebrehet se p\u00ebr t\u00eb identifikuar dob\u00ebsin\u00eb, modeli ishte n\u00eb gjendje t\u00eb nd\u00ebrtonte nj\u00eb zinxhir arsyetimi, duke marr\u00eb parasysh mund\u00ebsin\u00eb e lidhjeve paralelisht. server<\/a> dhe p\u00ebrdorimin e strukturave t\u00eb dh\u00ebnash n\u00eb situata t\u00eb ndryshme. <\/p>\n