PoC Published: Linux Kernel 0-Click RCE Vulnerability Found in ksmbd

According to BitsByWill, a security researcher who conducted a deep-dive into ksmbd, two Linux kernel flaws—CVE-2023-52440 and CVE-2023-4130—affect ksmbd, the in-kernel SMB server. The first, CVE-2023-52440, is a controlled SLUB overflow in ksmbd_decode_ntlmssp_auth_blob, enabling an unauthenticated heap overflow during SMB session setup when a crafted NTLM message is produced.

The second, CVE-2023-4130, stems from improper validation of extended attribute buffers in smb2_set_ea(), allowing an attacker with write access to SMB shares to trick ksmbd into misinterpreting crafted structures and leaking kernel memory. The analysis demonstrates how pairing the overflow with the leak primitive enables write and read access to kernel memory, with a proof-of-concept exploit showing a ROP chain that yields a reverse shell.

The article notes that patches have been issued and suggests that misconfigurations and outdated systems continue to present opportunities, with the discussion specifically referencing Linux 6.1.45 and its backport to 6.1.46.