Security researchers Dave G. and Alex Radocea have uncovered three significant vulnerabilities in macOS SMBClient, the system’s implementation for mounting remote SMB file shares.
These vulnerabilities, detailed in a recent security advisory, present serious risks including remote code execution and denial of service attacks.
The findings highlight critical flaws in both kernel and userland components of macOS’ SMB protocol implementation, with some vulnerabilities accessible through simple 2-click attacks via malicious smb:// URLs.
Remote Kernel Heap Overflow Threatens System Integrity
The most severe vulnerability, designated CVE-2025-24269, involves a remote kernel heap overflow in the smb2_rq_decompress_read function within the smbfs.kext kernel extension.
This flaw occurs when processing compressed SMB data using chained compression with algorithms including SMB2_COMPRESSION_LZNT1, SMB2_COMPRESSION_LZ77, and SMB2_COMPRESSION_LZ77_HUFFMAN.
The vulnerability stems from inadequate validation of the compress_len parameter read from network data.
When the compression path is taken, the system fails to validate this length before performing a memory copy operation through md_get_mem, which translates bcopy into the compress_startp buffer.
This oversight allows attackers to corrupt heap memory with controllable overflow quantities.
The technical analysis reveals that attackers can influence both the size of corrupted memory and the overflow amount, with initial buffer lengths potentially reaching 32MB (2*kDefaultMaxIOSize).
The vulnerability utilizes the SMB_MALLOC_DATA macro, which wraps kalloc_data, placing the overflow in the xnu data heap that offers some hardening by restricting pointer presence.
Kerberos Authentication Vulnerability
The second critical flaw, CVE-2025-24235, resides in the Kerberos Helper library used during SMB session establishment.
This vulnerability involves a remote _asn1_free() call on an uninitialized stack variable within the _KRBDecodeNegTokenInit function, potentially leading to remote code execution.
The vulnerability manifests when the gss_decapsulate_token function fails during authentication processing.
The NegotiationToken The structure is declared on the stack but remains uninitialized when the failure occurs, causing the code to skip initialization logic and proceed directly to the cleanup phase.
Subsequently, _free_NegotiationToken is called on uninitialized memory, eventually triggering _asn1_free() with corrupted data.
This sequence provides attackers with multiple opportunities to manipulate memory through the ASN.1 parsing and freeing process.
The vulnerability can be triggered remotely through malicious smb:// URLs or via mount_smbfs, making it accessible through social engineering attacks.
Privilege Escalation Through Signal Manipulation
The third vulnerability, currently without a CVE designation, enables unprivileged processes to send SIGTERM signals to any system process through the SMBIOC_UPDATE_NOTIFIER_PID local.
This flaw exists in the SMB filesystem’s notification mechanism for the multichannel support process.
The vulnerability occurs because the kernel fails to verify whether the calling process has permission to signal the target process ID.
When SMB filesystems unmount, the kernel sends SIGTERM to the registered notifier PID using proc_signal(mc_notifier_pid, SIGTERM).
Since any user can call the SMBIOC_UPDATE_NOTIFIER_PID ioctl to set this PID, attackers can effectively kill any process on the system, including launchd, which would crash the entire system.
While this vulnerability requires the ability to open /dev/nsmb and send ioctls, making it less immediately exploitable from within sandboxed environments, it represents a significant local privilege escalation vector.
Apple has addressed this issue by implementing entitlement checks for the problematic ioctl call, ensuring proper authorization before allowing PID registration.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates
%20(1).webp?fit=1600,900&ssl=1&description=These vulnerabilities, detailed in a recent security advisory, present serious risks including remote code execution and denial of service attacks.){kind=link}