0-Click Linux Kernel KSMBD Vulnerability Enables Remote Code Execution via N-Day Exploit

A recent vulnerability in the Linux Kernel’s KSMBD module allows an attacker to execute arbitrary code on a target system without any user interaction, according to GBHackers.

Researchers demonstrated a stable exploit against KSMBD in Linux 6.1.45 that achieves remote code execution with a reported success rate above 95 percent, using a two-stage chain that begins with an unauthenticated heap overflow during NTLM authentication (CVE-2023-52440) and continues with an authenticated bug in the Extended Attributes parser (CVE-2023-4130) to enable a write-leak primitive.

By crafting an oversized SMB2_SESSION_SETUP blob, the exploit creates a controlled SLUB overflow in a kmalloc-512 allocation, and then leverages the EA buffer to leak kernel pointers and bypass KASLR, allowing kernel ROP gadgets to hijack function pointers.

The researchers then construct a ROP chain to call call_usermodehelper and launch a user-mode reverse shell, with a sleep gadget to keep the kernel thread alive; KSMBD is often disabled in production, limiting impact, but any system on an outdated 6.1.x kernel with KSMBD exposed to untrusted networks is vulnerable.

The two CVEs have been patched, in early 2024 and late 2023 respectively, according to Zero Day Initiative, and administrators are advised to upgrade to kernel 6.1.46 or later and to apply standard hardening measures.