Two remote code execution flaws rated 9.0 on CVSS affecting the Linux kernel's KSMBD server were publicly disclosed before kernel patches were ready.
The reports cover issues in unauthenticated port 445 handling and SMB Direct transport, drawing maintainer criticism over disclosure timing.
The vulnerabilities were discovered by an artificial intelligence system and were publicized on mailing lists before an official fix was released by the developers. So far, no official update has been released to fix them in the Linux core code.
How are systems affected?
The first problem can be caused without any login or authentication process, on any server using the specific software on the primary connection port. The second problem requires special network equipment and access to a folder with write permissions.
Neither issue has an official identification code, as the Linux project only assigns codes to them after a solution is available.
READ ALSO
OpenCode vulnerability allowed third-party servers to execute commands on Windows
Criticism from Linux administrators
Because the issues were made public before the fixes were created, the code maintainers expressed their dissatisfaction with the process followed, pointing out that the reports were sent to public lists without being accompanied by ready-made fix code.
According to available data, some popular systems, such as Red Hat Enterprise Linux, do not include the service in question by default.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)