Security

KSMBD Exposure Checker

Two critical flaws in KSMBD, the Linux kernel's built-in SMB file server, were disclosed before any fix existed (ZDI-CAN-33774 and ZDI-CAN-33549, CVSS 9.0). Paste the output of the commands below to see if this server is exposed.

Run on the server and paste the outputuname -rlsmod | grep -E '^Module|ksmbd'systemctl is-active ksmbdss -ltn 'sport = :445'ls /sys/class/infiniband
Paste the command output

Paste the output of at least lsmod and systemctl from the list on the left. The checker needs to see whether the ksmbd module is loaded.

Turn KSMBD off until a fix ships

If you don't need KSMBD (most servers use Samba instead), stop it, unload the module and stop it from loading again:

sudo systemctl disable --now ksmbdsudo modprobe -r ksmbdecho 'install ksmbd /bin/false' | sudo tee /etc/modprobe.d/disable-ksmbd.conf

If you must keep it: allow port 445 only from trusted hosts at the firewall, remove guest shares, leave SMB Direct (RDMA) off, and watch your distribution's security tracker for a fixed kernel.

Checked in your browser. What you paste is never uploaded.

发现问题或有想法？ 报告问题

Share

您可能还喜欢