EN PT-BR
← Voltar ao feed
high

Public root exploit for unpatched Linux kernel LPE ZDI-CAN-33367; two CVSS 9.0 KSMBD flaws also unfixed after ZDI disclosures

3 fonte(s) · 3 atualização(ões) · publicado 22/10/2026 14:01 · coletado há 6 dias

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 27/10/2026 00:09; os links antigos trazem para cá.

Fontes: infosecurity-magazine.com ↗ gbhackers.com ↗ thehackernews.com ↗

Trend Micro's Zero Day Initiative (ZDI) sent six Linux-related reports, with no patches, to kernel maintainers and public mailing lists on October 20 and 21, 2026 (infosecurity-magazine.com, citing the Sysdig Threat Research Team analysis of October 24). Two are remote code execution flaws in KSMBD, the Linux kernel's in-kernel SMB server, each rated CVSS 9.0: ZDI-CAN-33774 and ZDI-CAN-33549 (thehackernews.com, gbhackers.com). As of 22-23 October 2026, neither has a fix in the mainline kernel or linux-next, and neither has a CVE identifier (thehackernews.com, gbhackers.com). A working public root exploit has also been released for the local privilege escalation ZDI-CAN-33367 before it received a CVE or a merged upstream fix, which makes it the most immediate concern of the six (infosecurity-magazine.com). ZDI-CAN-33774 can be triggered before authentication on port 445, while ZDI-CAN-33549 requires the SMB Direct transport and an RDMA-capable interface (thehackernews.com). The KSMBD bugs were credited to TrendAI, Trend Micro's AI scanner. Stable-kernel maintainer Greg Kroah-Hartman criticized publication without patches, and it remains unconfirmed whether the disclosures were accidental; ZDI had not publicly clarified its decisions as of 23 October (gbhackers.com). No in-the-wild exploitation had been reported as of the October 24 Sysdig analysis (infosecurity-magazine.com), and several flaws still had no fix in any released kernel.

Entenda a falha

A vulnerabilidade

Six unpatched ZDI reports hit the Linux kernel and ConnMan. The most severe are two CVSS 9.0 flaws in KSMBD, the in-kernel SMB server. ZDI-CAN-33774 is a pre-authentication race on port 445 that can read past a buffer, with a write path once the attacker has share access. Articles disagree on impact: RCE potential (The Hacker News, GBHackers) versus kernel memory leak and crash (Sysdig via Infosecurity). ZDI-CAN-33549 is an integer underflow in SMB Direct that needs RDMA, a writable share and a client negotiating SMB Direct. Also: ZDI-CAN-33367 (CVSS 7.8), a local privilege escalation in the networking stack, with a public root exploit; ZDI-CAN-34068 (8.8), a vmwgfx LPE; ZDI-CAN-34076, an NVMe target information leak; and ZDI-CAN-32005, a ConnMan stack overflow. None has a CVE or a mainline fix, and no affected or fixed versions are given.

Como funciona

For ZDI-CAN-33774, KSMBD workers pick a handler table for each incoming request. If a burst of short SMB1 packets is followed by an SMB2 packet in the same TCP write, workers end up treating SMB1 data with the SMB2 handler and read beyond the shorter buffer. For ZDI-CAN-33549, a client sends RDMA buffer descriptors where the first is longer than the declared payload. The server's size counter wraps, and a later memory copy overruns an allocated buffer. For ZDI-CAN-33367, the articles only say an unprivileged user can alter the in-memory contents of files they can only read, through a networking code path the earlier Dirty Frag fix missed.

Por que é vulnerável

ZDI-CAN-33774 is a race in how KSMBD assigns its handler table, so the handler can mismatch the data and read out of bounds. ZDI-CAN-33549 is missing validation of descriptor lengths against the declared payload, which allows an integer underflow and a later overrun. ZDI-CAN-33367 comes from an incomplete fix: the kernel patch for the earlier Dirty Frag page-cache flaws missed a related path. The articles do not explain why these went unnoticed, and there is no mainline fix to describe. A fix for 33549 is reportedly in a development branch (Phoronix via The Hacker News: submitted by Stefan Metzmacher; GBHackers: targeting Linux 7.5), unconfirmed.

Onde está

The articles name KSMBD's handler-table assignment (ZDI-CAN-33774), KSMBD's SMB Direct path (ZDI-CAN-33549), the skb_zerocopy networking code (ZDI-CAN-33367), the vmwgfx driver and the NVMe over Fabrics target; no file, function or fixing commit is public.

Como foi descoberta

ZDI sent the six reports, without patches, to kernel maintainers and public mailing lists on October 20 and 21, 2026. The reports credit TrendAI, Trend Micro's AI scanner, for the KSMBD bugs, and researcher p1r0x for ZDI-CAN-33367, per The Hacker News. GBHackers says developers had reportedly received an earlier independent report on 33367. Greg Kroah-Hartman criticized the lack of patches and the public routing. Kernel documentation updated in May 2026 treats AI-found bugs as already public, and it is unconfirmed whether the disclosure was accidental. Sysdig analyzed the batch on October 24 and saw no in-the-wild exploitation.

PoC pública

A working public root exploit exists for ZDI-CAN-33367, released before a CVE or merged upstream fix. The articles do not name its author or give a repository. TuxCare reproduced a root shell with it on AlmaLinux 8-10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04, so it is a functioning exploit, not just a crash. This makes it the most urgent of the six, especially on multi-user hosts. Sysdig suggests restricting unprivileged user namespaces, which TuxCare has not validated and which rootless containers need. The articles mention no public PoC for the other flaws.

Publicada em: www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes/ ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 00:24.

Detalhes técnicos

  • ZDI-CAN-33774 (CVSS 9.0): an unauthenticated race in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes workers process SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A write-past-buffer path also exists once an attacker has share access (thehackernews.com). gbhackers.com describes it more generally as a race in queued network request handling leading to out-of-bounds memory access and potential RCE. infosecurity-magazine.com describes it as a remote, pre-authentication flaw that can leak kernel memory and crash systems.
  • ZDI-CAN-33549 (CVSS 9.0): an integer underflow in the KSMBD SMB Direct path. A client supplies RDMA buffer descriptors in which the first is longer than the declared payload; the size counter wraps and a later memory copy overruns an allocated buffer. Exploitation needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share and a client negotiating SMB Direct (thehackernews.com). Exposure depends on configuration and whether SMB Direct is enabled (gbhackers.com).
  • KSMBD is distinct from Samba, so systems running only Samba are not automatically affected (gbhackers.com).
  • ZDI-CAN-33367 (CVSS 7.8, infosecurity-magazine.com): local privilege escalation in the Linux networking code (skb_zerocopy per thehackernews.com) that lets an unprivileged user alter the in-memory contents of files they can only read. It sits in a code path missed by the kernel fix for the earlier Dirty Frag page-cache flaws. TuxCare reproduced a root shell with the public PoC on AlmaLinux 8-10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04 (infosecurity-magazine.com). It was found by researcher p1r0x (thehackernews.com); developers reportedly received an earlier independent report and are working on a patch (gbhackers.com).
  • Other reports in the same ZDI batch, not affecting KSMBD servers: ZDI-CAN-34068 (CVSS 8.8 per infosecurity-magazine.com; local privilege escalation, out-of-bounds write in the VMware virtual GPU driver vmwgfx; no patch exists and only the report title was public); ZDI-CAN-34076 (information disclosure, uninitialized resource in the NVMe over Fabrics target driver); ZDI-CAN-32005 (stack-buffer overflow in ConnMan search-domain TCP query handling; a user-space service, not the kernel).

Remediação

  • Prioritize by the components you run rather than by CVSS score (infosecurity-magazine.com).
  • Check KSMBD exposure with systemctl status ksmbd or lsmod | grep ksmbd (thehackernews.com).
  • Disable or unload KSMBD if unused. If required, restrict port 445 and file sharing to trusted networks, review share permissions and evaluate SMB Direct exposure (gbhackers.com, thehackernews.com, infosecurity-magazine.com).
  • Red Hat Enterprise Linux does not include KSMBD by default (thehackernews.com).
  • For ZDI-CAN-33367, restricting unprivileged user namespaces should block the public PoC; TuxCare has not validated this, and rootless containers depend on those namespaces (infosecurity-magazine.com). AlmaLinux had patched kernels in testing, but not production, by October 23 (infosecurity-magazine.com).
  • On VMware guests, watch for a vmwgfx patch for ZDI-CAN-34068 (infosecurity-magazine.com).
  • No mainline patch exists for the KSMBD flaws; fixes typically take weeks to reach stable and distribution kernels. Monitor distribution advisories and apply vendor updates once available. Network restrictions are not a substitute for patches (gbhackers.com).

Relatos divergentes

  • Fix status for ZDI-CAN-33549: thehackernews.com, citing Phoronix, says SMB Direct maintainer Stefan Metzmacher submitted a fix targeting the next kernel development cycle, unconfirmed elsewhere. gbhackers.com (more recent) says a fix reportedly exists in a development branch targeting Linux 7.5, and cautions that this does not mean released kernels or distribution packages include it. Both agree there is no mainline fix yet; the fix is unverified.
  • Finder attribution: both credit Trend Micro's AI scanner; thehackernews.com names it TrendAI. gbhackers.com also says updated kernel guidance reportedly treats AI-discovered bugs as already public, which is not corroborated by thehackernews.com.
  • Impact of ZDI-CAN-33774: thehackernews.com and gbhackers.com describe potential remote code execution, while infosecurity-magazine.com (most recent, citing Sysdig) describes kernel memory leak and system crash. The CVSS 9.0 rating is common to all; RCE is not confirmed as demonstrated.
  • ZDI-CAN-33367 patch status: gbhackers.com says developers are working on a patch after an earlier independent report; infosecurity-magazine.com (more recent) reports a public root exploit and no merged upstream fix, with only distribution patches in testing at AlmaLinux as of October 23.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 26/10/2026 11:00 · coletado 26/10 11:01

    Public root exploit released for unpatched Linux kernel LPE ZDI-CAN-33367 alongside five other undisclosed kernel flaws

    ler a análise desta fonte

    A working exploit for a Linux kernel local privilege escalation flaw, tracked as ZDI-CAN-33367, was made public before the bug received a CVE identifier or a merged upstream fix. Trend Micro's Zero Day Initiative (ZDI) sent this report and five others to maintainers and public mailing lists on October 20 and 21, according to the Sysdig Threat Research Team analysis of October 24. No in-the-wild exploitation had been reported at that point, but several flaws still had no fix in any released kernel. The public root exploit makes ZDI-CAN-33367 the most immediate concern of the six.

    Technical Details

    • ZDI-CAN-33367 (CVSS 7.8): LPE in the Linux networking stack that lets an unprivileged user alter the in-memory contents of files they can only read. It sits in a code path missed by the kernel fix for the earlier Dirty Frag page-cache flaws. TuxCare reproduced a root shell with the public PoC on AlmaLinux 8-10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04.
    • ZDI-CAN-33774 (CVSS 9.0): remote, pre-authentication flaw in ksmbd (the kernel SMB server) that can leak kernel memory and crash systems.
    • ZDI-CAN-33549 (CVSS 9.0): ksmbd flaw that requires SMB Direct (RDMA) and a writable share.
    • ZDI-CAN-34068 (CVSS 8.8): LPE in the kernel's VMware graphics driver (vmwgfx). No patch exists and only the report title was public.
    • ZDI-CAN-34076: information leak in the kernel NVMe target.
    • ZDI-CAN-32005: userspace stack overflow in the ConnMan network manager.

    Remediation

    • Prioritize by the components you run rather than by CVSS score.
    • Unload ksmbd where it is not needed, and restrict port 445 to trusted networks where it must stay.
    • Watch for a vmwgfx patch on VMware guests.
    • For ZDI-CAN-33367, restricting unprivileged user namespaces should block the public PoC. TuxCare has not validated this, and rootless containers depend on those namespaces.
    • AlmaLinux had patched kernels in testing, but not production, by October 23.
  2. gbhackers.com ↗ · pub. 23/10/2026 02:17 · coletado 23/10 03:00

    Unpatched Linux KSMBD RCE flaws and other kernel bugs disclosed publicly via ZDI reports without fixes

    ler a análise desta fonte

    In October 2026, technical details of several unpatched Linux vulnerabilities appeared on public mailing lists before fixes were widely available. The reports were submitted by Trend Micro's Zero Day Initiative (ZDI), and the most severe are two remote code execution flaws in KSMBD, the in-kernel SMB server. Kernel maintainer Greg Kroah-Hartman questioned why the issues were published without patches. It remains unconfirmed whether the disclosures were accidental. The reports credit Trend Micro's AI scanner with the discoveries, and updated kernel guidance reportedly treats AI-discovered bugs as already public. As of October 23, 2026, ZDI had not publicly clarified its submission decisions.

    Technical Details

    • ZDI-CAN-33774 (CVSS 9.0): a race condition in KSMBD's handling of queued network requests. Inconsistent request handling can cause out-of-bounds memory access and potentially remote code execution.
    • ZDI-CAN-33549 (CVSS 9.0): an integer underflow in KSMBD's SMB Direct implementation produces an incorrect length value, so later memory operations exceed buffer limits. Exposure depends on configuration and on whether SMB Direct is enabled. A fix reportedly exists in a development branch targeting Linux 7.5, but that does not guarantee that released kernels or distribution packages include it.
    • Neither critical flaw had a fix in the mainline kernel or its integration tree, and neither had a CVE assigned at the time of reporting.
    • ZDI-CAN-33367: skb_zerocopy networking code, local privilege escalation. Developers reportedly received an earlier independent report and are working on a patch.
    • ZDI-CAN-34068: out-of-bounds write in the VMware graphics driver, local privilege escalation.
    • ZDI-CAN-34076: uninitialized resource in the NVMe over Fabrics target implementation, information exposure.
    • ZDI-CAN-32005: stack-buffer overflow in ConnMan's handling of search-domain TCP queries. ConnMan is a user-space service, not a kernel component.
    • KSMBD is distinct from Samba, so systems running only Samba are not automatically affected.

    Remediation

    • Check whether KSMBD is enabled and needed. Disable it if it is unused.
    • If KSMBD is required, restrict file sharing to trusted networks, review share permissions, and evaluate SMB Direct exposure.
    • Monitor distribution security advisories rather than assuming upstream development changes have reached deployed systems.
    • Apply vendor-approved updates promptly once available. Network restrictions alone are not a substitute for patches.
  3. thehackernews.com ↗ · pub. 22/10/2026 14:01 · coletado 22/10 16:00 primeiro registro

    Two CVSS 9.0 Linux KSMBD RCE flaws (ZDI-CAN-33774, ZDI-CAN-33549) disclosed publicly with no mainline kernel fix

    ler a análise desta fonte

    Trend Micro's Zero Day Initiative (ZDI) disclosed two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, each rated CVSS 9.0. As of Thursday neither has a named fix in the mainline kernel or linux-next, and neither has a CVE identifier yet. ZDI-CAN-33774 can be triggered before authentication on port 445. ZDI-CAN-33549 requires the SMB Direct transport and an RDMA-capable interface. ZDI credited TrendAI, Trend Micro's AI scanner, as the finder. The reports were copied to public kernel mailing lists without patches, which drew criticism from stable-kernel maintainer Greg Kroah-Hartman. The article does not report exploitation in the wild.

    Technical Details

    • ZDI-CAN-33549: an integer underflow in KSMBD's SMB Direct path. A client supplies RDMA buffer descriptors in which the first is longer than the declared payload. The size counter wraps, and a later memory copy overruns the end of an allocated buffer. Exploitation needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct.
    • ZDI-CAN-33774: an unauthenticated race in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes workers process SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A write-past-buffer path also exists once an attacker has access to a share.
    • Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle. This is not confirmed elsewhere.
    • The same ZDI batch includes three unrelated kernel reports that do not affect KSMBD servers: ZDI-CAN-33367 (local privilege escalation in the networking stack, found by researcher p1r0x), ZDI-CAN-34068 (local privilege escalation in the VMware virtual GPU driver) and ZDI-CAN-34076 (information disclosure in the NVMe target driver). A sixth report, ZDI-CAN-32005, is a buffer overflow in ConnMan, which is separate from the kernel.

    Remediation

    • No patch is available in mainline. Fixes typically take weeks to reach stable branches and distribution kernels.
    • Check exposure with systemctl status ksmbd or lsmod | grep ksmbd.
    • Red Hat Enterprise Linux does not include KSMBD by default, per Red Hat's support documentation.
    • Where KSMBD is active, restrict access to port 445 until fixes ship (the article gives no explicit mitigation).