[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance based on the public ZDI ksmbd reports (Oct 21-22)

Tip: until the ksmbd fixes ship, find Linux hosts running the in-kernel SMB server and turn it off or fence port 445

  • Find it: lsmod | grep ksmbd, systemctl status ksmbd and ss -ltnp 'sport = :445'. A listener on 445 with no smbd process behind it is a sign of ksmbd. Check NAS and appliance images too, since that is where ksmbd usually turns up.
  • If you don't need it: stop the service, then modprobe -r ksmbd and blacklist the module (for example echo "blacklist ksmbd" > /etc/modprobe.d/no-ksmbd.conf).
  • If you do: remove guest shares (ZDI-CAN-33774 needs one), turn off SMB Direct/RDMA unless you use it (ZDI-CAN-33549 needs it), and allow TCP 445 only from trusted subnets. Never expose it to the internet.
  • Then: watch your distribution's kernel advisories for the ksmbd fixes, since no CVEs exist yet to track.

Sources: LKML archive: ZDI-CAN-33774 report and Greg KH reply (Oct 21-22) · Phoronix: Several Linux kernel vulnerabilities accidentally posted to public list (Oct 22)