Security readout for executives and security teams
Plain-English summary
A remote, authenticated SMB user may make a vulnerable Linux ksmbd server read beyond an internal stream buffer. This can expose kernel memory or disrupt the server. The flaw only arises when ksmbd uses the streams_xattr VFS configuration, substantially narrowing exposure.
Executive priority
Treat as a high-priority patch for exposed ksmbd servers using streams_xattr, especially where SMB is reachable across broad or untrusted networks. Systems not running ksmbd or not using that configuration are unlikely to meet the documented trigger. There is no supplied evidence of active exploitation.
Technical view
CVE-2024-56627 is a CWE-125 out-of-bounds read in ksmbd_vfs_stream_read. A client-controlled negative offset can access data outside stream_buf when streams_xattr is configured. CVSS 3.1 is 8.1: network-accessible, low complexity, low privileges, no user interaction, with potentially high confidentiality and availability impact.
Likely exposure
Prioritize Linux systems providing SMB through ksmbd with “vfs objects = streams_xattr” enabled. Exploitation requires low-privileged access according to the supplied CVSS vector. The bundle lists affected kernel versions, but its version data contains anomalies; confirm exposure against distribution advisories and the referenced stable fixes.
Exploitation context
The supplied record is not in CISA KEV, and none of the provided sources establishes active exploitation or public weaponization. Exploitation status therefore remains unconfirmed. Network reachability and authenticated SMB access increase practical risk, while the required streams_xattr configuration limits the exposed population.
Researcher notes
The central condition is a client-supplied negative offset reaching ksmbd_vfs_stream_read under streams_xattr. The supplied affected-version list includes repeated commit identifiers and an anomalous “0,” so it should not be treated as a clean version range. Use vendor package status or inclusion of the stable fixes for definitive validation.
Mitigation direction
- Install a supported distribution or kernel update incorporating the referenced Linux stable fixes.
- Confirm the exact fixed package or kernel release through the operating-system vendor.
- If operationally acceptable, disable streams_xattr until the corrected kernel is deployed.
- Restrict SMB access to trusted networks and authorized accounts while remediation is pending.
Validation and detection
- Identify systems running ksmbd and record their kernel and distribution package versions.
- Check ksmbd.conf for the streams_xattr VFS object setting.
- Compare installed kernels with vendor advisories and the referenced stable fix commits.
- After updating, verify the running kernel changed and normal SMB stream operations still work.
- Review SMB and kernel logs for crashes or unusual authenticated client activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56627 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6bd1bf0e8c42f10a9a9679a4c103a9032d30594dCVE reference, Linux
- https://git.kernel.org/stable/c/de4d790dcf53be41736239d7ee63849a16ff5d10CVE reference, Linux
- https://git.kernel.org/stable/c/27de4295522e9a33e4a3fc72f7b8193df9eebe41CVE reference, Linux
- https://git.kernel.org/stable/c/81eed631935f2c52cdaf6691c6d48e0b06e8ad73CVE reference, Linux
- https://git.kernel.org/stable/c/fc342cf86e2dc4d2edb0fc2ff5e28b6c7845adb9CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.