CVE-2022-47943

What it actually does

Out-of-bounds read in ksmbd SMB2_WRITE handler when a large length value is supplied in the zero DataOffset case, resulting in kernel OOPS.

Why it matters to the business

Systems exposing SMB shares via ksmbd can experience denial-of-service crashes or limited information disclosure, disrupting file services and requiring reboots.

How an attack unfolds

An authenticated network attacker crafts an SMB2_WRITE request with an oversized length field while DataOffset is zero; the kernel performs an out-of-bounds memory read that triggers an OOPS and potential information leak.

How to fix it

Upgrade the Linux kernel to a version containing commit ac60778b87e45576d7bfdbd6f53df902654e6f09 (or later) in the 5.15–5.19 series; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm kernel version is newer than the vulnerable range, reproduce SMB2_WRITE traffic in a test environment, and verify absence of OOPS in dmesg.

Typical attack path

1. Establish TCP connection to SMB port 445
2. Perform SMB negotiation and session setup with valid credentials
3. Issue SMB2_WRITE command containing large length and DataOffset=0
4. Trigger kernel OOPS and observe crash or memory disclosure

How to detect it

Review kernel logs for oops/panic entries referencing ksmbd and SMB2_WRITE; inspect network captures for anomalous SMB2_WRITE packets with large length and zero DataOffset.

What your security team should do

• Prioritize kernel upgrade on all hosts running ksmbd
• Disable ksmbd if SMB server functionality is not required
• Monitor for kernel panics on SMB-exposed systems until patched
• Apply network segmentation to limit SMB exposure