ETERNAL-TUX: CRAFTING A LINUX KERNEL KSMBD 0-CLICK RCE EXPLOIT FROM N-DAYS

Summary from the TLDR InfoSec newsletter

A stable authenticated 0-click remote code execution exploit against Linux's kernel SMB3 daemon (ksmbd) chains two existing CVEs: CVE-2023-52440 for controlled heap overflow, and CVE-2023-4130 for memory leakage, targeting Linux 6.1.45 with full mitigations enabled. The exploit leverages NTLM authentication flaws to overflow a 512-byte SLUB allocation, then uses an arbitrary free primitive to corrupt a 1KB ksmbd_conn object and hijack a vtable pointer to achieve ROP-based code execution via call_usermodehelper. The technique demonstrates how N-day vulnerabilities can be chained together for reliable exploitation despite modern kernel protections, though it requires authenticated SMB access and is limited by the relative rarity of ksmbd deployments in production environments.