Tickling and unleashing ksmbd

Two articles about fuzzing and remotely exploiting ksmbd — the Linux kernel SMB module — by notselwyn.

The first article describes how the author used syzkaller and KCOV for coverage-guided fuzzing of ksmbd.

The second article demonstrates how to exploit two of the found bugs: a null-pointer-dereference that leads to a DoS and an out-of-bounds read that leads to an info-leak.