# ksmbd vulnerability research

Three unauthenticated ksmbd flaws: a sessions_table race causing UAF, a session refcount UAF in preauth hashing, and unbounded work allocation causing kernel OOM panic.

- Payout: Research
- Severity: high
- Program: Linux kernel
- Credited: Doyensec
- Disclosed: 2025-01-06
- CVE: CVE-2024-50286, CVE-2024-50283, CVE-2024-50285
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2025/01/07/ksmbd-1.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-01-07-ksmbd-1-html
- Tags: domain:oss impact:dos kind:research platform:research sev:high tech:linux technique:fuzzing technique:race-window technique:source-review vuln:dos vuln:memory-corruption vuln:race-condition

**Target:** ksmbd SMB3 kernel server on port 445
**Root cause:** CVE-2024-50286: sessions_table hash operations (hash_add/hash_del) lack locking between ksmbd_expire_session and ksmbd_sessions_deregister, causing UAF. CVE-2024-50283: ksmbd_user_session_put frees sess before smb3_preauth_hash_rsp dereferences it. CVE-2024-50285: work structs allocated before credit limits enforced.
**Steps:**
1. Extend syzkaller grammar with SMB2 commands from smb2pdu.c; tag first negotiate packet with 8-byte instance id
2. Patch NTLMv2 auth and signature checks in pseudo-syscalls to reach ioctl/session-setup paths without valid signatures
3. CVE-2024-50286: open many simultaneous connections so sessions expire; race ksmbd_session_register/ksmbd_expire_session against ksmbd_server_terminate_conn/ksmbd_sessions_deregister to double hash_del and kfree sess
4. CVE-2024-50283: trigger SMB2_SESSION_SETUP so refcnt hits zero and sess freed, then smb3_preauth_hash_rsp reads sess->Preauth_HashValue
5. CVE-2024-50285: send large volume of packets over remote socket for ~2 minutes; ksmbd_work_cache grows past 2000 threads until OOM panic
**How found:** Intercepted legitimate SMB traffic with strace and Kaitai Struct to build valid packets, extended syzkaller grammar for smb2pdu.c commands, patched auth/signature checks to fuzz deeper; syzkaller hit the two UAFs but produced no reproducer, requiring manual crash-report analysis; the OOM bug was found by manual testing sending many packets.
**Exploitation:** All three reachable pre-authentication during session setup. UAFs give OOB write at offset 112 in kmalloc-512 (no full exploit built due to time constraints); the work-cache exhaustion remotely panics and reboots the kernel.
**Insight:** Session lifecycle code that mixes per-connection session_lock with a global sessions_table_lock is a race magnet: audit paths where expire/register/deregister touch the same hash entry under different locks. Also check that resource allocation (work structs, threads) happens after credit/quota enforcement, not before.