vulnerability particulars

Simply in time for Christmas, we’ve a 9.6 (of 10) vulnerability in some Linux kernels (5.15 and later) that may be exploited for distant code execution (RCE) with out authentication on network-enabled ports, however solely on programs the place the ksmbd kernel module is enabled are susceptible.

The precise flaw exists throughout the processing of the SMB2_TREE_DISCONNECT instructions. The issue is attributable to the shortage of validation of the existence of an object earlier than performing operations on the article. An attacker can exploit this vulnerability to execute code within the context of the kernel.

ADDITIONAL DETAILS

Linux has launched an replace to repair this vulnerability. Extra particulars will be discovered at:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.61

disclosure schedule

2022-07-26 – Vulnerability reported to vendor
2022-12-22 – Coordinated public launch of discover

CyberHoot Suggestion:

It is a Vital Vulnerability in response to our Vulnerability Alert Administration Course of (VAMP). That is the dangerous new. The excellent news is that the ksmbd kernel module is probably not in use in your distributions. Any distribution that makes use of Linux kernel 5.15 or increased is probably susceptible. This consists of Ubuntu 22.04 and its descendants; Deepin Linux 20.3; and Slackware 15. For server functions, Ubuntu is essentially the most regarding. Different enterprise distributions, such because the Pink Hat Enterprise Linux (RHEL) household, don’t use the 5.15 kernel.

That is how it’s checked:
$ uname -r

To see what model of the kernel you’re working.

In case you are working a inclined kernel, verify if the susceptible module is current and actively working:

$ modinfo ksmb

What you need to see is that the module was not discovered. If it is loaded, you may need to improve to Linux kernel 5.15.61.

Sadly, many distributions haven’t moved to this kernel model but. If that is the case, you may must disable this kernel module till a repair is ​​launched.