CVE-2022-50859

What it actually does

The flaw causes the VALIDATE_NEGOTIATE_INFO SMB3 message to be constructed with an incorrect extended length (28 bytes instead of 26) after adding the 3.1.1 dialect, leaving two bytes of uninitialized kernel memory that may be sent over the network.

Why it matters to the business

Low-probability exposure of kernel memory contents during SMB3 negotiation could aid reconnaissance or supply material for further attacks in environments using CIFS/SMB3 file sharing; urgency remains low given stable EPSS and absence from KEV.

How an attack unfolds

An attacker establishes an SMB3 connection to a vulnerable Linux system, triggers dialect negotiation that includes smb3.1.1, receives the oversized VALIDATE_NEGOTIATE_INFO response containing uninitialized bytes, and inspects the captured network frames for leaked kernel data.

How to fix it

Apply the upstream fix (commit d0050ec3ebbcb3451df9a65b8460be9b9e02e80c) or upgrade to a kernel containing the corrected length calculation; affected graphicsmagick packages on Debian 11-14 are listed as fixed in 1.4~hg15880-1.

How to confirm the fix worked

Confirm the VALIDATE_NEGOTIATE_INFO message is exactly 26 bytes on the wire and verify the running kernel contains commit d0050ec3ebbcb3451df9a65b8460be9b9e02e80c or later.

Typical attack path

1. Establish SMB3 session to target
2. Negotiate dialects including 3.1.1
3. Observe VALIDATE_NEGOTIATE_INFO reply of 28 bytes
4. Extract and analyze the two trailing uninitialized bytes from the message

How to detect it

Inspect network captures or SMB logs for VALIDATE_NEGOTIATE_INFO messages whose length field indicates 28 bytes rather than the expected 26 bytes.

• VALIDATE_NEGOTIATE_INFO length 28 bytes

What your security team should do

• Prioritize kernel updates on systems exposing SMB3 shares
• Review network segmentation for SMB traffic
• Monitor EPSS trend for any future increase