In the Linux kernel, the following vulnerability has been resolved:
ksmbd: use opener credentials for FSCTL mutations
SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB
handle but call VFS xattr, fallocate or fileattr helpers with the current
ksmbd worker credentials. Those helpers can revalidate inode permissions,
ownership and LSM policy independently of the SMB handle access mask.
Run each operation with the credentials captured in the target file when
the handle was opened. Keep credential handling local to these single-file
FSCTLs rather than applying session credentials to the complete IOCTL
handler, which also contains handle-less and multi-handle operations.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1
AV:N - The flaw is in ksmbd's SMB2 IOCTL handler, reachable remotely over TCP/445 (or SMB Direct) via smb2_ioctl() processing FSCTL_SET_SPARSE, FSCTL_SET_ZERO_DATA, and FSCTL_SET_COMPRESSION after SMB2 session setup and tree connect.
AC:L - An attacker deterministically opens a target file handle and sends the FSCTL; smb2_ioctl() never calls ksmbd_override_fsids(), so VFS helpers always run with privileged worker credentials instead of filp->f_cred, making the bypass reliable without races or external timing.
PR:N - Although a valid SMB session, writable tree, and handle with FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES are required, ksmbd supports passwordless guest sessions on guest-writable shares, so exploitation does not require prior host privileges in a reasonable deployment.
UI:N - The attacker directly issues SMB2 IOCTL requests against handles it opened; no separate victim action such as mounting a share, opening a file, or clicking a prompt is required beyond network access to ksmbd.
S:U - The credential bypass permits unauthorized file metadata and content mutations within the same host kernel and exported filesystem security authority; it does not cross VM, container, IOMMU, or comparable isolation boundaries.
C:N - These FSCTLs only mutate sparse/compression xattrs or zero/punch file ranges via vfs_fallocate and vfs_fileattr helpers; they provide no read primitive, kernel memory disclosure, or alternate unauthorized data exfiltration path.
I:H - Privileged ksmbd worker credentials bypass opener UID, group, capability, inode, and LSM revalidation in vfs_fallocate, vfs_fileattr_set, and ksmbd_vfs_set_dos_attrib_xattr, enabling unauthorized sparse/compression attribute changes and arbitrary-range zeroing or hole-punching of protected files.
A:H - Repeated FSCTL_SET_ZERO_DATA requests can persistently destroy or corrupt critical exported files and dependent services by zeroing or punching arbitrary ranges with root-equivalent credentials, causing sustained loss of share data and service availability until restoration.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
None |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is in ksmbd's SMB2 IOCTL handler, reachable remotely over TCP/445 (or SMB Direct) via smb2_ioctl() processing FSCTL_SET_SPARSE, FSCTL_SET_ZERO_DATA, and FSCTL_SET_COMPRESSION after SMB2 session setup and tree connect.
AC:L - An attacker deterministically opens a target file handle and sends the FSCTL; smb2_ioctl() never calls ksmbd_override_fsids(), so VFS helpers always run with privileged worker credentials instead of filp->f_cred, making the bypass reliable without races or external timing.
PR:N - Although a valid SMB session, writable tree, and handle with FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES are required, ksmbd supports passwordless guest sessions on guest-writable shares, so exploitation does not require prior host privileges in a reasonable deployment.
UI:N - The attacker directly issues SMB2 IOCTL requests against handles it opened; no separate victim action such as mounting a share, opening a file, or clicking a prompt is required beyond network access to ksmbd.
S:U - The credential bypass permits unauthorized file metadata and content mutations within the same host kernel and exported filesystem security authority; it does not cross VM, container, IOMMU, or comparable isolation boundaries.
C:N - These FSCTLs only mutate sparse/compression xattrs or zero/punch file ranges via vfs_fallocate and vfs_fileattr helpers; they provide no read primitive, kernel memory disclosure, or alternate unauthorized data exfiltration path.
I:H - Privileged ksmbd worker credentials bypass opener UID, group, capability, inode, and LSM revalidation in vfs_fallocate, vfs_fileattr_set, and ksmbd_vfs_set_dos_attrib_xattr, enabling unauthorized sparse/compression attribute changes and arbitrary-range zeroing or hole-punching of protected files.
A:H - Repeated FSCTL_SET_ZERO_DATA requests can persistently destroy or corrupt critical exported files and dependent services by zeroing or punching arbitrary ranges with root-equivalent credentials, causing sustained loss of share data and service availability until restoration.
CVSS 3.1