ืืื ืื ksmbd ืืึธืืืืข, ืืืึธืก ืึธืคืคืขืจืก ืึท ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืึท ืืขืงืข ืกืขืจืืืขืจ ืืืืืจื ืืืืฃ ืื SMB ืคึผืจืึธืืึธืงืึธื ืืขืืืื ืืื ืื ืืื ืืงืก ืงืขืจื, 14 ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืืืืขื ืึทืคืืื, ืคืืจ ืคืื ืืืึธืก ืืึธืื ืืืื ืขืจ ืฆื ืจืืืึธืืืื ืืืกืคืืจื ืืืื ืงืึธื ืืื ืงืขืจื ืจืขืื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื ืขืก ืืื ืืขื ืื ืึทื ืื ksmbd ืืึธืืืืข ืืื ืึทืงืืืืืืืืื ืืืืฃ ืื ืกืืกืืขื. ืคึผืจืึธืืืขืืก ืืขืจืฉืืึทื ืขื ืกืืึทืจืืื ื ืคืื ืงืขืจื 5.15, ืืืึธืก ืื ืงืืืืขื ืื ksmbd ืืึธืืืืข. ืื ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืคืึทืจืคืขืกืืืงื ืืื ืงืขืจื ืืขืจืืืึทื ืืืงืื ืืขื 6.3.2, 6.2.15, 6.1.28 ืืื 5.15.112. ืืืจ ืงืขื ืขื ืฉืคึผืืจ ืื ืคืืงืกืื ืืื ืื ืืืกืืจืืืืืฉืึทื ื ืืืืฃ ืื ืคืืืืขื ืืข ืืืขืืขืจ: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Gentoo, Arch.
ืืืืขื ืึทืคืืื ืืฉืื:
- CVE-2023-32254, CVE-2023-32250, CVE-2023-32257, CVE-2023-32258 - ืืืจืืคืืจืื ื ืคืื ืืืืึทื ืงืึธื ืืื ืงืขืจื ืจืขืื ืจืขืื ืฆื ืืขืจ ืคืขืื ืคืื ืืขืืขืจืืง ืึทืืืืฉืขืงืฅ ืืึทืงืื ื ืืืขื ืคึผืจืึทืกืขืกืื ื ืคืื ืืจืืืกื ืืืง ืจืืงืืืขืก ืืื ืื SMB2_TREE_DISCON , SMB2_TREE_DISCON, SMB2_TREE_DISCON, SMB2_TREE_DISCON, SMBXNUMX_TREE_DISCON SMBXNUMX_CLOSE, ืืืึธืก ืจืขืืืืืึทืื ืืื ืึท ืขืงืกืคึผืืืืืึทืืึทื ืจืึทืกืข ืฆืืฉืืึทื ื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
- CVE-2023-32256 - ืืืงืื ื ืื ืืื ืืึทืื ืคืื ืงืขืจื ืืึผืจืื ืืงืืืืช ืจืขืื ืฆื ืึท ืจืึทืกืข ืฆืืฉืืึทื ื ืืขืฉืึทืก ืื ืคึผืจืึทืกืขืกืื ื ืคืื SMB2_QUERY_INFO ืืื SMB2_LOGOFF ืงืึทืืึทื ืื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
- CVE-2023-32252, CVE-2023-32248 - ืืืืึทื ืึธืคึผืืืืงืขื ืื ื ืคืื ืืื ืกื ืจืขืื ืฆื ืึท NULL ืืืึทืื ืืขืจืคืขืจืึทื ืก ืืืขื ืคึผืจืึทืกืขืกืื ื ืื SMB2_LOGOFF, SMB2_TREE_CONNECT ืืื SMB2_QUERY_INFO ืงืึทืืึทื ืื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
- CVE-2023-32249 - ืืขืืืขืืงืืื ืคืื ืกืขืกืืข ืืืืืืฉืึทืงืื ื ืืื ืึท ืืึทื ืืฆืขืจ ืจืขืื ืฆื ืคืขืื ืคืื ืืขืืขืจืืง ืืคืืขืืื ืืขืจืืงืืื ืืืขื ืืึทื ืืืื ื ืึท ืกืขืกืืข ืฉืืึทื ืืื ืืืืื-ืงืึทื ืึทื ืืึธืืข.
- CVE-2023-32247, CVE-2023-32255 - ื ืึธืคึผืืืืงืขื ืื ื ืคืื ืืื ืกื ืจืขืื ืฆื ืึท ืืึผืจืื ืจืื ืขื ืืืขื ืคึผืจืึทืกืขืกืื ื ืื SMB2_SESSION_SETUP ืืึทืคึฟืขื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
- CVE-2023-2593 ืืื ืึท ืึธืคึผืืืืงืขื ืื ื ืคืื ืืื ืกื ืจืขืื ืฆื ืืืืึธืกืืฉืึทื ืคืื ืื ืืืฆื ืืึผืจืื, ืืขืคึฟืืจื ืืืจื ืึท ืืึผืจืื ืืืจืืคืึทื ืืืขื ืคึผืจืึทืกืขืกืื ื ื ืืึท ืืงืคึผ ืงืึทื ืขืงืฉืึทื ื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
- CVE-2023-32253 ื ืึธืคึผืืืืงืขื ืื ื ืคืื ืืื ืกื ืจืขืื ืฆื ืึท ืืขืืืึทืง ืึทืงืขืจื ืืืขื ืคึผืจืึทืกืขืกืื ื ืื SMB2_SESSION_SETUP ืืึทืคึฟืขื. ืื ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
- CVE-2023-32251 - ืคืขืื ืคืื ืฉืืฅ ืงืขืื ืืจืื ืงืจืึทืคื ืื ืคืืื.
- CVE-2023-32246 ื ืืืืข ืกืืกืืขื ืืึทื ืืฆืขืจ ืืื ืื ืจืขืื ืฆื ืึทื ืืึธืื ืื ksmbd ืืึธืืืืข ืงืขื ืขื ืืขืจืืจืืืื ืงืึธื ืืืจืืคืืจืื ื ืืืืฃ ืื ืืื ืืงืก ืงืขืจื ืืืจืื.
ืืื ืึทืืืฉืึทื, 5 ืืขืจ ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืืืืขื ืึทืคืืื ืืื ืื ksmbd-tools ืคึผืขืงื, ืืืึธืก ืืืื ืืืืืืึทืืื ืคึฟืึทืจ ืึธื ืคืืจืื ื ืืื ืืจืืขืื ืืื ksmbd, ืขืงืกืึทืงืืืืึทื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ. ืื ืืขืจืกื ืืขืคืขืจืืขื ืืืึทืื ืขืจืึทืืืืืืื (ZDI-CAN-17822, ZDI-CAN-17770, ZDI-CAN-17820, CVE ื ืึธื ื ืืฉื ืึทืกืืื ื) ืืึธืื ืึท ืืืืึทื, ืึทื ืึธืืขื ืืืงืืืืื ืึทืืึทืงืขืจ ืฆื ืืืกืคืืจื ืืืืขืจ ืงืึธื ืืื ืืืึธืจืฆื ืจืขืื. ืื ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืืขืคึฟืืจื ืืืจื ืื ืคืขืื ืคืื ืงืึธื ืืจืึธืืืจืื ื ืื ืืจืืืก ืคืื ืืืงืืืขื ืคืื ืืจืืืกื ืืืง ืืึทืื ืืืืืขืจ ืงืึทืคึผืืื ื ืขืก ืฆื ืื ืืึทืคืขืจ ืืื ืื WKSSVC ืกืขืจืืืืก ืงืึธื ืืื ืืื ืื LSARPC_OPNUM_LOOKUP_SID2 ืืื SAMR_OPNUM_QUERY_USER_INFO ืึธืคึผืงืึธืืข ืืึทื ืืืขืจืก. ืฆืืืื ืืขืจ ืืืึทืื ืขืจืึทืืืืืืื (ZDI-CAN-17823, ZDI-CAN-17821) ืงืขื ืขื ืคืืจื ืฆื ืืืืึทื ืึธืคึผืืืืงืขื ืื ื ืคืื ืืื ืกื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื.
Ksmbd ืืื ืืึทืืืื ืืื ืึท ืืืื-ืคืึธืจืฉืืขืืื ื, ืขืืืขืืื-ืืจืืื ืกืึทืืืึท ืคืึทืจืืขื ืืขืจืื ื ืืืึธืก ืื ืืึทืืจืืืฅ ืืื ืกืึทืืืึท ืืืฉืืจืื ืืื ืืืืืจืขืจืื ืืื ืืืจืฃ. ืฉืืืฆื ืคึฟืึทืจ ืคืืืกื ืืืง ืึท SMB ืกืขืจืืืขืจ ื ืืฆื ืื ksmbd ืืึธืืืืข ืืื ืคืึธืจืฉืืขืื ืืื ืื Samba ืคึผืขืงื ืืื ื ืืขืืืื ื 4.16.0. ื ืื ืขื ืืขื ืึท SMB ืกืขืจืืืขืจ ืืืึธืก ืืืืคื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ksmbd ืืื ืืขืจ ืขืคืขืงืืืื ืืื ืืขืจืืื ืขื ืคืื ืคืึธืจืฉืืขืืื ื, ืืึผืจืื ืงืึทื ืกืึทืืฉืึทื ืืื ืื ืืึทืืจืืืฉืึทื ืืื ืึทืืืึทื ืกืืจืืข ืงืขืจื ืงืืืคึผืึทืืืืึทืืื. ืืืจื Steve French ืคืื ืืืืงืจืึธืกืึธืคึฟื, ืึท ืืึทืื ืืึทืืืขืจ ืคืื ืื CIFS / SMB2 / SMB3 ืกืึทืืกืืกืืึทืื ืืื ืื ืืื ืืงืก ืงืขืจื ืืื ืึท ืืึทื ื-ืฆืืื ืืืืืืื ืคืื ืืขืจ Samba ืึทื ืืืืืงืืื ื ืืึทื ืฉืึทืคึฟื, ืืื ืืขืืืื ืืึทืืืึทืืืง ืงืึทื ืืจืึทืืืืฉืึทื ื ืฆื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืฉืืืฆื ืคึฟืึทืจ ืื SMB / CIFS ืคึผืจืึธืืึธืงืึธืืก ืืื Samba ืืื ืืื ืืงืก.
ืึทืืืืืืึธื ืึทืืื, ืฆืืืื ืืืึทืื ืขืจืึทืืืืืืื ืงืขื ืขื ืืืื ืืืืขืจืงื ืืื ืื vmwgfx ืืจืึทืคืืงืก ืืจืืืืืขืจ, ืืขื ืืฆื ืฆื ืื ืกืืจืืืขื ื 3 ื ืึทืงืกืขืืขืจืืืฉืึทื ืืื VMware ืื ืืืืืจืึทื ืืึทื ืฅ. ืืขืจ ืขืจืฉืืขืจ ืืืึทืื ืขืจืึทืืืืืื (ZDI-CAN-20292) ืึทืืึทืื ืึท ืืืืข ืืึทื ืืฆืขืจ ืฆื ืขืกืงืึทืืืื ืืืืขืจ ืคึผืจืืืืืืึทืืืฉืึทื ืืื ืื ืกืืกืืขื. ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืจืขืื ืฆื ืึท ืคืขืื ืคืื ืงืึธื ืืจืึธืืืจืื ื ืื ืฉืืึทื ืคืื ืึท ืืึทืคืขืจ ืืืืืขืจ ืคืจืื ืขืก ืืืขื ืคึผืจืึทืกืขืกืื ื ืึท vmw_buffer_object, ืืืึธืก ืงืขื ืจืขืืืืืึทื ืืื ืึท ืืึธืคึผื ืจืืคื ืฆื ืื ืคืจืื ืคืื ืงืฆืืข. ืื ืจืืข ืืืึทืื ืขืจืึทืืืืืื (ZDI-CAN-20110) ืคืืจื ืฆื ืึท ืจืื ืขื ืคืื ืงืขืจื ืืึผืจืื ืืื ืืึทืื ืจืขืื ืฆื ืขืจืจืึธืจืก ืืื ืึธืจืืึทื ืืืืื ื ืื ืืึทืงืื ื ืคืื ืืืืืฉืืืื ืึทืืืืฉืขืงืฅ.
ืืงืืจ: opennet.ru