⬇ Download holy card: ·
Saint SMBleed, Bleeding Brother of SMBGhost
Patron of network shares, SMBv3 compression, and bugs that come in pairs.
Life
On 9 June 2020, Microsoft's Patch Tuesday, ZecOps revealed SMBleed (CVE-2020-1206), in the same SMBv3 decompression function that months earlier had given us SMBGhost. It let an attacker read uninitialised kernel memory remotely; on its own it was a leak, but paired with SMBGhost it became unauthenticated remote code execution. It affected Windows 10 from version 1903.
Prayer
O Saint SMBleed, who bleeds from the same wound as your ghostly brother, let our compression zero its memory before sending it. Amen.
How to celebrate
Celebrated by installing the June 2020 updates, blocking port 445 from the Internet and disabling SMBv3 compression where it is not needed.
Where there's a ghost, there's a bleeder close by.