CVE-2022-47940

What it actually does

Missing length validation in the non-padding case of smb2_write in fs/ksmbd/smb2pdu.c allows out-of-bounds memory access leading to memory corruption during SMB2 write handling.

Why it matters to the business

Remote attackers with valid credentials can read sensitive kernel memory or crash file-sharing services, causing data exposure and service outages on Linux systems using ksmbd.

How an attack unfolds

An authenticated remote attacker sends crafted SMB2 write requests with manipulated lengths that bypass validation checks, triggering memory corruption that can be leveraged for information disclosure or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 158a66b245739e15858de42c0ba60fcf3de9b8e6 which adds the missing length validation in smb2pdu.c; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel source tree contains commit 158a66b245739e15858de42c0ba60fcf3de9b8e6, then exercise SMB2 write operations with boundary and oversized length values while monitoring for crashes or corruption.

Typical attack path

1. Locate Linux systems exposing ksmbd on TCP port 445
2. Authenticate using valid SMB credentials
3. Transmit SMB2 write PDUs with invalid or oversized lengths in the non-padding path
4. Trigger out-of-bounds access to read memory contents or induce kernel panic

How to detect it

Review kernel logs for ksmbd write-related errors or panics, and inspect network captures for SMB2 write requests containing unusual length fields or padding mismatches.

• ksmbd.*smb2_write
• fs/ksmbd/smb2pdu.c
• SMB2 WRITE request with non-padding length mismatch

What your security team should do

• Apply the referenced kernel commit or later stable release immediately on all systems running ksmbd
• Temporarily disable ksmbd or restrict SMB access to trusted networks until patched
• Add kernel and SMB traffic monitoring for anomalous write requests