CVE-2024-56627

What it actually does

Negative client-supplied offset in ksmbd_vfs_stream_read causes out-of-bounds read from stream_buf when streams_xattr is enabled in ksmbd.conf, resulting in memory corruption.

Why it matters to the business

Attackers may read sensitive kernel memory contents or trigger crashes in file-sharing services, leading to data exposure or service disruption on affected systems.

How an attack unfolds

An attacker connects to a ksmbd share configured with streams_xattr, crafts an SMB read request containing a negative offset, and triggers the vulnerable stream read path to access memory outside the allocated buffer.

How to fix it

Upgrade affected packages to the listed fixed versions such as qemu 2.0.0+dfsg-2ubuntu1.26 on Ubuntu 14.04 LTS; disable streams_xattr in ksmbd.conf if immediate patching is not possible.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases, confirm streams_xattr is disabled or absent from ksmbd.conf, and test SMB read operations with negative offsets in a lab environment.

Typical attack path

1. Identify ksmbd instance with streams_xattr enabled
2. Establish authenticated or guest SMB session
3. Send crafted read request with negative offset value
4. Trigger out-of-bounds read from stream_buf
5. Observe returned memory contents or crash

How to detect it

Review ksmbd and SMB server logs for unusual negative offset values in read requests, monitor for crashes or memory access violations tied to stream_buf handling, and search kernel logs for related oops or panic messages.

• streams_xattr
• ksmbd_vfs_stream_read
• negative offset
• stream_buf

What your security team should do

• Apply the listed fixed package versions immediately due to kernel memory exposure risk
• Audit ksmbd.conf files across all hosts for streams_xattr usage
• Monitor EPSS and threat actor reports for any increase in exploitation activity
• Restrict SMB access to trusted networks until patches are deployed