Lucene search

K
zdiArnaud Gatignol, Quentin Minster, Florent Saudel, Guillaume Teissier (@thalium_team)ZDI-22-1688
HistoryDec 22, 2022 - 12:00 a.m.

Linux Kernel ksmbd Heap-based Buffer Overflow Remote Code Execution Vulnerability

2022-12-2200:00:00
Arnaud Gatignol, Quentin Minster, Florent Saudel, Guillaume Teissier (@thalium_team)
www.zerodayinitiative.com
56
linux kernel
ksmbd
heap-based buffer overflow
remote code execution
authentication
file attributes
validation
user-supplied data
kernel.

0.006 Low

EPSS

Percentile

77.9%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of file attributes. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel.

0.006 Low

EPSS

Percentile

77.9%