Linux Kernel KSMBD SMB3 Key Logging Vulnerability

A vulnerability in the Linux kernel's KSMBD component allows for the logging of sensitive key information during SMB3 signing and encryption key generation. When KSMBD_DEBUG_AUTH logging is activated, the functions generate_smb3signingkey() and generate_smb3encryptionkey() inadvertently log session, signing, encryption, and decryption key bytes. This logging could expose credentials, creating a security risk.

Impact

The vulnerability could lead to the unintentional exposure of sensitive encryption and signing keys, potentially allowing for unauthorized access or manipulation of data in SMB3 communications.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux Kernel Archive.