CVE-2022-47942

What it actually does

Heap-based buffer overflow in ksmbd triggered by processing a malformed SMB2_SET_INFO_HE command followed by SMB2_QUERY_INFO_HE, allowing out-of-bounds writes in the Linux kernel SMB server.

Why it matters to the business

Remote attackers with authenticated SMB access can crash affected Linux file servers or potentially execute arbitrary code, leading to data loss, service outages, or full system compromise on systems running vulnerable kernels with ksmbd enabled.

How an attack unfolds

An attacker establishes an SMB session, issues a specially crafted SMB2_SET_INFO_HE command to set up the overflow condition, then follows with SMB2_QUERY_INFO_HE to trigger the heap corruption and gain control of execution flow.

How to fix it

Upgrade the Linux kernel to a version containing commit 8f0541186e9ad1b62accc9519cc2b7a7240272a7 or later; disable ksmbd if the service is not required.

How to confirm the fix worked

Verify the running kernel version is 5.19.2 or newer, confirm the presence of the fix commit in the kernel source, and test that ksmbd no longer processes the malformed command sequence without crashing.

Typical attack path

1. Authenticate to ksmbd over SMB
2. Send malformed SMB2_SET_INFO_HE command
3. Send SMB2_QUERY_INFO_HE to trigger overflow
4. Overwrite heap structures to achieve code execution or denial of service

How to detect it

Review SMB audit logs and kernel logs for unusual SMB2_QUERY_INFO_HE or SMB2_SET_INFO_HE sequences, unexpected ksmbd crashes, or heap-related panics around the time of publication or any subsequent exploitation attempts.

What your security team should do

• Apply the kernel fix containing commit 8f0541186e9ad1b62accc9519cc2b7a7240272a7 immediately on all systems exposing ksmbd
• Disable ksmbd on systems where SMB server functionality is unnecessary
• Monitor EPSS trend for any future increase indicating rising exploit likelihood
• Review network exposure of SMB ports and apply least-privilege access controls