"리눅스 커널에서 발견된 초고위험도 취약점, SMB 서버 위협"

SMB3 프로토콜을 커널 내에 구현한 ksmbd에서 초고위험도 취약점 발견. ksmbd는 리눅스 커널 5.15에서 처음 도입. 대부분은 사용자들은 ksmbd가 아니라 삼바를 사용하기에 취약점의 영향이 광범위하지는 않음.

#IT #리눅스 #보안 #SMB #ksmbd

https://www.boannews.com/media/view.asp?idx=113013

Una vulnerabilità con score 10 sul Kernel Linux è stata scoperta

Nel modulo #ksmbd è stata scoperta una #vulnerabilità critica del #kernel #Linux estremamente pericolosa.

Ha ricevuto l’identificativo CVE-2022-47939 e 10 punti su 10 possibili nella scala #CVSS. Ksmbd è un modulo del kernel Linux che implementa un file #server basato sul protocollo #SMB3 per lo scambio di file utilizzando lo #standard Samba.

Gli #esperti raccomandano agli amministratori che utilizzano ksmbd di aggiornare il kernel Linux alla versione 5.15.61 o successiva.

#redhotcyber #informationsecurity #ethicalhacking #dataprotection #hacking #cybersecurity #cybercrime #cybersecurityawareness #cybersecuritytraining #cybersecuritynews #privacy #infosecurity

https://lnkd.in/dmHq3f6A

https://securityaffairs.co/wordpress/140013/hacking/critical-linux-kernel-vulnerability.html

#linux #Vulnerabillity #ksmbd

The lack of co-ordinated disclosure on ZDI-22-1690 is appalling. IT'S THREE DAYS BEFORE CHRISTMAS YOU ABSOLUTE IDIOTS, GET IT TOGETHER. I literally don't know if this is 5 mins work tomorrow, or if my Christmas just disappeared. It's complete insanity. https://www.zerodayinitiative.com/advisories/ZDI-22-1690/

#linux #kernel #smb #ksmbd

CVSS 10.0 RCE in Linux kernel ksmbd component:

https://www.zerodayinitiative.com/advisories/ZDI-22-1690/

Appears to have been patched in 5.15.61 in August, so anyone keeping up with upstream security patches ought to be okay?

Fix in upstream commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c

No CVE appears to as yet have been assigned. (Which is somewhat upsetting given this bug was spotted and fixes 6 months ago!)

#ksmbd #linux #security #vulnerability