CVE-2024-22705

What it actually does

Out-of-bounds memory access in smb_strndup_from_utf16 triggered by incorrect parsing of Name versus CreateContexts fields in smb2_get_data_area_len, allowing local memory corruption in the ksmbd SMB server.

Why it matters to the business

Local users on affected Linux systems can potentially escalate privileges or crash the kernel, leading to unauthorized access or denial of service on file-sharing services; the flaw has been present for nearly three years with low but stable exploitation probability.

How an attack unfolds

A local attacker with a user account crafts a malicious SMB2 CREATE request that supplies inconsistent Name and CreateContexts data lengths, causing the kernel to read past allocated buffers during UTF-16 string duplication and resulting in memory corruption that can be leveraged for code execution or crashes.

How to fix it

Update the Linux kernel to a version containing commit d10c77873ba1e9e6b91905018e29e196fd5f863d (equivalent to 6.6.10 or newer stable releases) and rebuild any custom kernel modules; disable ksmbd if SMB serving is not required.

How to confirm the fix worked

Verify kernel version is at least 6.6.10 or contains commit d10c77873ba1e9e6b91905018e29e196fd5f863d; recompile and boot the patched kernel, then confirm smb2misc.c no longer contains the vulnerable length calculation logic.

Typical attack path

1. Obtain local shell access on a system running vulnerable ksmbd
2. Send a specially formatted SMB2 CREATE request over the loopback or local interface
3. Trigger smb2_get_data_area_len to miscalculate data areas
4. Cause out-of-bounds read in smb_strndup_from_utf16
5. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel audit logs and dmesg for out-of-bounds access warnings or crashes originating from fs/smb/server/smb2misc.c; correlate with unusual local SMB client activity on loopback interfaces.

What your security team should do

• Prioritize kernel upgrade on all systems exposing ksmbd within the next 30 days
• Audit configurations to ensure ksmbd is only enabled where SMB file sharing is explicitly needed
• Monitor for local privilege-escalation attempts via kernel audit logs until patches are applied