Critical Linux Kernel Vulnerability Discovered – Patch Now

Summary

Zero Day Initiative (ZDI) discovered a critical Linux kernel vulnerability in KSMBD that may allow remote code execution. KSMBD is a Linux kernel daemon that implements the SMB3 protocol in kernel space for sharing files over a network. The vulnerability, CVE-2022-47939, was originally designated with a CVSS score of 10 by ZDI, though was downgraded to 9.6. The flaw resides in the processing of SMB2_TREE_DISCONNECT commands and affects Linux kernel 5.15 through 5.19 before 5.19.2. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of a remote unauthenticated user. Depending on the privileges associated with the user, a threat actor could then install programs; view, change, or delete data; or create new accounts with full user rights.

Recommendations

The NJCCIC urges administrators to update vulnerable systems immediately after appropriate testing. Further details and recommendations can be found in the CISecurity advisory.