A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. To exploit the vulnerability against a server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it.

SMBGhost is an integer overflow vulnerability in the Windows 10 SMB driver srv2.sys (in server) and mrxsmb.sys (in client). The vulnerability occurs while handling the SMB2_COMPRESSION_TRANSFORM_HEADER by Srv2DecompressData() function which allows allocation of buffers of incorrect size leading to buffer overflows.  This occurs only when the OriginalCompressedSegmentSize and offset/length fields are fed with large values which when added together overflows the DWORD allocation size and resulting in a small destination buffer for decompressed data thus causing Out-of-Bounds write. The vulnerable code exists in both SMB client and SMB server. We have published a detailed analysis of the vulnerability along with mitigation techniques.