Critical Linux ksmbd Vulnerability Could Allow Unauthenticated Remote Code Execution
Summary
CVE-2022-47939 affects Linux systems with the ksmbd module enabled. The flaw in SMB2_TREE_DISCONNECT handling could allow unauthenticated remote code execution; Linux 5.15.61 and later address the issue.
Key points
- The flaw affects the Linux kernel’s in-kernel SMB server module, ksmbd; systems using Samba are not affected.
- An attacker may exploit the bug remotely without authentication when ksmbd is enabled.
- The issue stems from processing SMB2_TREE_DISCONNECT commands without checking whether an object exists before operating on it, potentially enabling kernel-level code execution.
- The article says ksmbd is not enabled by default on most operating systems and reports that systems using it are rare.
- Linux 5.15.61 includes a fix; the article also lists affected and fixed Ubuntu and Debian packages, while Red Hat is listed as not impacted.
- Security teams are advised to update to Linux 5.15.61 or later and use Wiz’s pre-built query to find vulnerable instances.
Article Details
- Vulnerability Types
- Remote code execution
- Missing object-existence validation when processing SMB2_TREE_DISCONNECT commands
- Severity
- Critical; CVSS 10.0
- Affected Versions
- Linux kernel versions newer than 5.15, with ksmbd enabled
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
Vendors
Products
ksmbdA critical remote code execution vulnerability (CVE-2022-47939) has been identified in the ksmbd module of the Linux kernel. This means that remote attackers could potentially execute arbitrary code on affected systemsLinux kernelremote code execution vulnerability (CVE-2022-47939) has been identified in the ksmbd module of the Linux kernel. This means that remote attackers could potentially execute arbitrary code on affected systems running