SMBGhost

aka CoronaBlue, EternalDarkness

Product: Microsoft Windows SMBv3.1.1 (srv2.sys)
CVE: CVE-2020-0796
Disclosed: 2020-03-10
CVSS: 10
Auth: pre-auth
CISA KEV: yes
Affected: Windows 10 versions 1903 and 1909, Windows Server version 1903 and 1909 (Server Core).
Fixed: KB4551762 (12 March 2020).

Summary

An integer overflow in the SMBv3.1.1 compression feature, accidentally revealed before a patch was ready. Pre-authentication packets with a compression header could corrupt kernel memory on both SMB servers and clients, making it wormable.

Root cause

srv2.sys's Srv2DecompressData trusts the OriginalCompressedSegmentSize and Offset fields of the SMB2 COMPRESSION_TRANSFORM_HEADER; adding them without overflow checks wraps a 32-bit integer, allocating a small buffer that LZNT1 decompression then overflows. Public exploits combine this with a physical-memory read primitive to obtain kernel RCE.

Impact

Unauthenticated kernel RCE (or local privilege escalation) on affected Windows 10 / Server builds via TCP/445.

Public PoC

# RCE PoC (lab only; Windows 10 1903/1909). Replace USER_PAYLOAD in exploit.py (max 600 bytes) first.
# Can BSOD the target.
python exploit.py -ip 10.0.0.9

Source: chompie1337 - SMBGhost_RCE_PoC

Detection

nmap NSE scripts / ollypwn SMBGhost scanner check for SMB 3.1.1 negotiate responses advertising compression on vulnerable builds. Alert on SMB2 compression transform headers with abnormal size fields.

Mitigation

Install KB4551762. Workaround: disable SMBv3 compression (Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters DisableCompression -Type DWORD -Value 1); block TCP/445.