CVE-2022-47939: Critical RCE Vulnerability in Linux Kernel
A critical remote code execution vulnerability in the Linux kernel has been publicly disclosed by Trend Micro's Zero Day Initiative in its ZDI-22-1690 advisory. The vulnerability has been given a CVSSv3 of 10.0. There are no reports of active exploitation.
Background
On December 22, Trend Micro's Zero Day Initiative (ZDI) released an advisory detailing a critical remote code execution (RCE) vulnerability in the Linux kernel. The affected component, ksmbd, is a Server Message Block (SMB) file server module released in August 2021 in kernel version 5.15. Initially, the vulnerability details were released without a CVE identifier, however MITRE eventually assigned it CVE-2022-47939 on December 23.
ZDI disclosed the vulnerability to the Linux team in July 2022, and was patched on August 17 in the 5.15.61 release.
Analysis
CVE-2022-47939 is a use-after-free vulnerability in the ksmbd SMB file server module of the Linux kernel. According to the advisory, this vulnerability would allow an unauthenticated, remote attacker to execute arbitrary code on impacted systems that have ksmbd enabled. The vulnerability has been given the highest possible CVSSv3 score of 10.0 and is considered critical severity.
The vulnerability exists in the SMB2_TREE_DISCONNECT function of the module, which fails to verify an object's existence before it attempts performing operations on the object. However, because ksmbd is not widely adopted and is not enabled by default in most Linux operating systems, it is unlikely that active exploitation will be seen in the future.
Proof of concept
At the time this blog was published, no proof-of-concept code had been released for CVE-2022-47939.
Vendor response
The maintainers released patches in August 2022. Because the ksmbd module was recently introduced in kernel version 5.15 and is not enabled by default in most Linux operating system (OS) variants, most Linux users are likely unaffected. Below is a table of OS distributions that have so far commented on impact:
| Distribution | Status |
|---|---|
| Red Hat Enterprise Linux (RHEL) 6-9 | Not Affected |
| Debian buster | Not Affected |
| Debian bullseye | Not Affected |
| Debian Unstable | Affected, fixed in 5.19.6-1 |
| Gentoo | Not Affected |
| Ubuntu bionic | Not Affected |
| Ubuntu focal | Not Affected |
| Ubuntu jammy | Affected (5.15.0-53.59), pending release |
| Ubuntu kinetic | Not Affected |
| Ubuntu trusty | Not Affected |
| Ubuntu upstream | Fixed in 6.0~rc1 |
| Ubuntu xenial | Not Affected |
Solution
As Linux distributions can vary significantly in their implementation of components, customers are advised to consult the vendor relevant to their distribution. Red Hat, Ubuntu and Debian have issued advisories.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as it is released and will be updated as more vendors address this flaw. This link uses a search filter to ensure that all matching Tenable coverage will appear as it becomes available. In addition, a detection plugin (plugin ID 169382) has been released to identify hosts that have the ksmbd service installed. However, the ksmbd service does not provide a version number of the kernel from which it was distributed and, therefore, the detection plugin should not be used as the sole test for whether a service is vulnerable. Tenable Research recommends relying on our plugins based on the specific Linux vendor advisories for the various distributions to cover this CVE.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Related Articles
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
Context Is King: From Vulnerability Management to Exposure Management
November 7, 2024Vulnerability management remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from vulnerability management to exposure management and effectively prioritize high-risk exposures across their complex attack surface.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
Cybersecurity Snapshot: CISA Warns of Global Spear-Phishing Threat, While OWASP Releases AI Security Resources
November 8, 2024CISA is warning about a spear-phishing campaign that spreads malicious RDP files. Plus, OWASP is offering guidance about deepfakes and AI security. Meanwhile, cybercriminals have amplified their use of malware for fake software-update attacks. And get the latest on CISA’s international plan, Interpol’s cyber crackdown and ransomware trends.
Context Is King: From Vulnerability Management to Exposure Management
November 7, 2024Vulnerability management remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from vulnerability management to exposure management and effectively prioritize high-risk exposures across their complex attack surface.
- Exposure Management