Security Bulletin for Linux ksmbd Vulnerability ZDI-22-1690
On 2022-12-22, the Zero Day Initiative (ZDI) published a security advisory, ZDI-22-1690, regarding a vulnerability in the ksmbd service in the Linux kernel. The vulnerability can be exploited only if the ksmbd service is enabled.
Pure Storage products and services are not affected by this vulnerability. Pure does not include nor enable this service in any of our products.
No corrective action is required for any Pure Storage products.
General Mitigation Best Practices
Pure Storage recommends following network security best practices that minimize the risk of compromise:
Restrict management interfaces to a trusted set of networks. Please see Best practices on restricting public IP addresses. Additional security posture hardening may be achieved by restricting all control plane access through a jump box (bastion host).
Restrict outbound Internet access to trusted destinations. Phone Home and Remote Assist (RA) require port 443 (https) to be open to CloudAssist subnet 188.8.131.52/27 for outbound traffic. A firewall will need to permit inbound traffic for the established connection.
Pure Storage strongly encourages the widely-endorsed best practice of highly restricting -- if not blocking altogether -- Internet access to management interfaces, including connections via SSH, TLS, remote consoles, and remote desktop mechanisms.
Closely monitor arrays for abnormal or unexpected workload/ IO spikes or utilization as a leading indicator.
Enable edge detection/protection mechanisms in the firewall / IDS / IPS systems to detect anomalous access or traffic patterns.
If you would like one of our engineers to assist you with this issue please call +1 866-244-7121. If calling from outside the US here is a list of phone numbers: https://support.purestorage.com/Pure1/Support.
Support Escalation - How To Escalate a Case
If you believe that you may have been actively exploited, please call +1 866-244-7121 and request for a Severity 1 case to be created.
For all other requests for assistance that are not an active Severity 1 / outage/ critical issue, please contact Pure Storage Technical Services for assistance.
If calling from outside the US here is a list of phone numbers: https://support.purestorage.com/Pure1/Support. Pure Storage customers can escalate cases in the following ways:
Call Pure Storage Support and ask to speak with the Support Manager on Duty.
PHONE (US) +1 866-244-7121 or +1 650-729-4088
PHONE (INTERNATIONAL) support.purestorage.com/pure1/support
Click the escalation link on one of the case emails. Every email from Pure Storage Support displays the following question near the bottom, including a dynamic link: “Not satisfied with the handling of this case? Click here to escalate.”
In the upper right-hand Pure1 Case Portal, click Escalate.
Please also see: Customer Escalation Procedures for additional information.