by Kastro
Paper/Archive/CVE-2023-52441

CVE-2023-52441

Linux Linux — ksmbd: fix out of bounds in init_smb2_rsp_hdr()

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 52.4.524 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false.

Affected

ProductAffectedFixed inSource
Linux51a8534c0f35c0401e45f1055f914729cad98bf9 – < 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40bCNA
Linux0b3ec5671ac06829ccebdaeec05acedfec327f42 – < 330d900620dfc9893011d725b3620cd2ee0bc2bc330d900620dfc9893011d725b3620cd2ee0bc2bcCNA
Linux39b291b86b5988bf8753c3874d5c773399d09b96 – < aa669ef229ae8dd779da9caa24e254964545895faa669ef229ae8dd779da9caa24e254964545895fCNA
Linux39b291b86b5988bf8753c3874d5c773399d09b96 – < 536bb492d39bb6c080c92f31e8a55fe9934f452b536bb492d39bb6c080c92f31e8a55fe9934f452bCNA
Linuxcc32cd98a0aee4cc3eb611cbce11795b1aaa738a–CNA
Linux5.15.105 – < 5.15.1455.15.145CNA
Linux6.1.22 – < 6.1.536.1.53CNA
Linux6.2.9 – < 6.36.3CNA
Linux6.36.1.53CNA

Scores by source

Linux (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40brefgit.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bcrefgit.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895frefgit.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b