Thalium_Team

**Name of the Vulnerable Software and Affected Versions** Philips Hue Bridge (affected versions not specified) **Description** The Philips Hue Bridge contains a heap-based buffer overflow in the hk hap characteristics component. This issue allows for remote code execution. The vulnerability was discovered during the Pwn2Own competition and credited to the Thalium team from Thales Group. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of `SMB2 TREE CONNECT` and `SMB2 QUERY INFO` commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this issue to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel's ksmbd (affected versions not specified) **Description** The issue is related to errors in synchronization when using a shared resource in the Linux kernel's ksmbd module, a high-performance in-kernel SMB server. The specific flaw exists within the processing of `SMB2 SESSION SETUP` commands. The problem results from the lack of proper locking when performing operations on an object. An attacker can leverage this to execute code in the context of the kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The issue results from the lack of proper locking when performing operations on an object, specifically within the processing of SMB2 SESSION SETUP and SMB2 LOGOFF commands. An attacker can leverage this vulnerability to execute code in the context of the kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2 LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel ksmbd (affected versions not specified) **Description** A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of "SMB2 TREE DISCONNECT" commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this issue to execute code in the context of the kernel. The exploitation of this flaw may allow a remote attacker to impact the integrity, availability, and confidentiality of protected information and execute arbitrary code using the "SMB2 TREE DISCONNECT" command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The issue results from the lack of control of resource consumption when handling SMB2 SESSION SETUP commands. An attacker can leverage this to create a denial-of-service condition on the system. The vulnerability is related to incorrect resource release, allowing a remote attacker to cause a denial-of-service using the SMB2 SESSION SETUP command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.15 through 5.19 before 5.19.2 **Description** A use-after-free issue exists in the Linux kernel's ksmbd module, specifically in the `fs/ksmbd/smb2pdu.c` file, related to the `SMB2 TREE DISCONNECT` command. This issue can be exploited by a remote attacker to execute arbitrary code on vulnerable Linux kernel versions. The ksmbd server, which implements the SMB3 protocol in the kernel for network file sharing, is affected when it handles `SMB2 TREE DISCONNECT` commands without properly checking the existence of an object before performing operations on it. **Recommendations** For Linux kernel versions 5.15 through 5.19 before 5.19.2, update to version 5.19.2 or later to resolve the issue. As a temporary workaround, consider disabling the ksmbd server until a patch is available. Restrict access to the `SMB2 TREE DISCONNECT` command to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.15 through 5.19 before 5.19.2 **Description** The issue is related to a heap-based buffer overflow in the Linux kernel's ksmbd subsystem, specifically in the set ntacl dacl function. This overflow is connected to the use of `SMB2 QUERY INFO HE` after a malformed `SMB2 SET INFO HE` command. The exploitation of this issue could allow a remote attacker to execute arbitrary code. **Recommendations** For Linux kernel versions 5.15 through 5.19 before 5.19.2, update to version 5.19.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `set ntacl dacl` function and the `SMB2 QUERY INFO HE` and `SMB2 SET INFO HE` commands until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.15 through 5.19 before 5.19.2 **Description** An issue was discovered in ksmbd in the Linux kernel, related to a memory leak due to the omission of a `kfree` call in certain `smb2 handle negotiate` error conditions. This can be exploited by a remote attacker to cause a denial-of-service when handling SMB2 NEGOTIATE requests. The vulnerable code is located in `fs/ksmbd/smb2pdu.c`. **Recommendations** For Linux kernel versions 5.15 through 5.19 before 5.19.2, update to version 5.19.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `smb2 handle negotiate` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.15 through 5.19 before 5.19.2 **Description** The issue is related to the `smb2 write` function in the `ksmbd` module of the Linux kernel, which is vulnerable to an out-of-bounds read in memory. This can allow a remote attacker to disclose protected information or cause a denial of service. The vulnerability occurs when there is a large length in the zero `DataOffset` case for `SMB2 WRITE`. **Recommendations** For Linux kernel versions 5.15 through 5.19 before 5.19.2, update to version 5.19.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ksmbd` module or disabling the `smb2 write` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.15 through 5.19 before 5.19.2 **Description** The issue is related to an out-of-bounds read in the Linux kernel's ksmbd subsystem, specifically in the fs/ksmbd/smb2misc.c file. This occurs when handling the SMB2 TREE CONNECT operation. Exploitation of this issue can allow a remote attacker to cause a denial of service. **Recommendations** For Linux kernel versions 5.15 through 5.19 before 5.19.2, update to version 5.19.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the SMB2 TREE CONNECT operation until a patch is available.