# ksmbd - Exploiting CVE-2025-37947 (3/3)

ksmbd_vfs_stream_write() OOB write via pos > XATTR_SIZE_MAX allows local root on Ubuntu 22.04 by corrupting msg_msg and pipe_buffer.

- Payout: Research
- Severity: high
- Program: ksmbd
- Credited: Doyensec
- Disclosed: 2025-10-07
- CVE: CVE-2025-37947
- Write-up quality: 9/10
- Original: https://blog.doyensec.com/2025/10/08/ksmbd-3.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-10-08-ksmbd-3-html
- Tags: domain:oss impact:privesc kind:research platform:research sev:high tech:linux technique:chained technique:source-review vuln:memory-corruption

**Target:** ksmbd_vfs_stream_write in Linux kernel ksmbd
**Root cause:** When pos+count exceeds XATTR_SIZE_MAX, size is truncated to 0x10000 but memcpy uses original pos, writing out-of-bounds.
**Steps:**
1. Configure ksmbd share with `vfs objects = streams_xattr` and `writeable = yes`.
2. Authenticate as smbuser/smbpassword via libsmb2.
3. Send SMB2 write request to stream with `file_offset = 0x10018` and `length_wr = 8`, data `0xaa...0xbb`.
4. Observe OOB write at `stream_buf+0x10018` via gdb breakpoint on memcpy.
5. Spray 1024 msg_msg objects of size 4096 to shape heap.
6. Trigger OOB write to corrupt msg_msg->next pointer, creating overlapping messages.
7. Detect corrupted pair via msgrcv(MSG_COPY) tag mismatch.
8. Free real secondary message to create UAF, reclaim with fake msg_msg via UNIX socket spray.
9. Leak kernel heap addresses via m_ts abuse, then KASLR via pipe_buffer spray.
10. Spray fake pipe_buf_operations with ROP chain, close pipes to trigger stack pivot and root shell.
**How found:** Analyzed ksmbd_vfs_stream_write() code, noticed size truncation without adjusting pos, hypothesized OOB write, confirmed with PoC.
**Exploitation:** Local attacker with SMB credentials triggers OOB write to corrupt msg_msg, escalates to UAF, leaks KASLR, and executes ROP chain for root.
**Escalation:** Chained OOB write -> msg_msg corruption -> UAF -> info leak -> KASLR bypass -> ROP -> root.
**Insight:** When auditing kernel code for OOB, check for size truncation that doesn't adjust the offset used in memcpy; also, heap grooming with msg_msg and pipe_buffer is effective for LPE.