{"id":125569,"date":"2025-05-25T15:05:07","date_gmt":"2025-05-25T13:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai"},"modified":"2025-05-25T15:05:07","modified_gmt":"2025-05-25T13:05:07","slug":"udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/udalyonnaya-uyazvimost-v-module-ksmbd-yadra-linux-vyyavlennaya-pri-pomoshhi-ai","title":{"rendered":"Dob\u00ebsi e cenueshme nga distanca n\u00eb modulin ksmbd t\u00eb kernelit Linux, e zbuluar me ndihm\u00ebn e AI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb modulit ksmbd, i cili ofron nj\u00eb realizim t\u00eb integruar n\u00eb b\u00ebrtham\u00ebn Linux t\u00eb serverit t\u00eb skedave mbi protokollin SMB, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2025-37899), e cila potencialisht lejon t\u00eb arrihet ekzekutimi i kodit n\u00eb nivelin e b\u00ebrtham\u00ebs p\u00ebrmes d\u00ebrgimit t\u00eb paketave t\u00eb formuara n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. E ve\u00e7ant\u00eb \u00ebsht\u00eb se problemi u identifikua gjat\u00eb analiz\u00ebs s\u00eb kodit nga modeli AI i OpenAI o3. Duke qen\u00eb se kodi i plot\u00eb i modulit ksmbd tejkalon madh\u00ebsin\u00eb e pranuar t\u00eb kontekstit p\u00ebr modelin, kontrolli u krye n\u00eb faza p\u00ebr kodin me realizimin e komandave t\u00eb ve\u00e7anta SMB, duke p\u00ebrdorur k\u00ebrkesa tipike. <\/p>\n
Dob\u00ebsia shkaktohet nga referimi te kujtesa e \u00e7liruar m\u00eb par\u00eb (use-after-free) n\u00eb kodin e trajtimit t\u00eb komand\u00ebs SMB \"logoff\": struktura sess->user u p\u00ebrdor n\u00eb nj\u00eb thread tjet\u00ebr, n\u00ebse n\u00eb kuad\u00ebr t\u00eb nj\u00eb lidhjeje tjet\u00ebr vinte nj\u00eb k\u00ebrkes\u00eb p\u00ebr vendosjen e nj\u00eb seance, e lidhur me seanc\u00ebn q\u00eb ishte \u00e7liruar. Gjat\u00eb trajtimit t\u00eb k\u00ebtyre k\u00ebrkesave, funksioni smb2_sess_setup ekzekutohej, i cili referohej te struktura e \u00e7liruar sess->user. <\/p>\n
Dob\u00ebsia \u00ebsht\u00eb adresuar n\u00eb p\u00ebrdit\u00ebsimet 6.15-rc5, 6.14.6, 6.12.28, 6.6.90, 6.1.138. N\u00eb degen 5.15, n\u00eb t\u00eb cil\u00ebn \u00ebsht\u00eb pranuar moduli ksmbd, problemi nuk shfaqet. Mund t\u00eb ndiqni adresimin e dob\u00ebsis\u00eb n\u00eb distribuimet n\u00eb faqet e m\u00ebposhtme: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Arch. <\/p>\n
Problemin e identifikoi Sean Heelan, krijuesi i platform\u00ebs s\u00eb profilizimit t\u00eb kodit Prodfiler, i specializuar n\u00eb optimizimin dhe auditet e siguris\u00eb s\u00eb kodit. Sean vendosi t\u00eb vler\u00ebsonte se sa t\u00eb avancuara jan\u00eb modelet moderne AI p\u00ebr t\u00eb kryer auditin e siguris\u00eb dhe arriti n\u00eb p\u00ebrfundimin se modeli o3 ka b\u00ebr\u00eb p\u00ebrparime t\u00eb konsiderueshme n\u00eb analizimin dhe kuptimin e struktur\u00ebs, logjik\u00ebs dhe funksionalitetit t\u00eb kodit. V\u00ebrehet se p\u00ebr t\u00eb identifikuar dob\u00ebsin\u00eb, modeli arriti t\u00eb ndihmoj\u00eb nj\u00eb zinxhir arsyetimi q\u00eb merrte parasysh mund\u00ebsin\u00eb e lidhjeve paralele. serverit<\/a> dhe p\u00ebrdorimin e strukturave t\u00eb dh\u00ebnash n\u00eb situata t\u00eb ndryshme. <\/p>\n