CVE-2023-52441
published 2024-02-21CVE-2023-52441: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.68%
51.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.55-1 (bookworm) | linux 6.1.55-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0b3ec5671ac06829ccebdaeec05acedfec327f42 < 330d900620dfc9893011d725b3620cd2ee0bc2bc | 330d900620dfc9893011d725b3620cd2ee0bc2bc |
| linux | linux | >= 39b291b86b5988bf8753c3874d5c773399d09b96 < aa669ef229ae8dd779da9caa24e254964545895f | aa669ef229ae8dd779da9caa24e254964545895f |
| linux | linux | >= 39b291b86b5988bf8753c3874d5c773399d09b96 < 536bb492d39bb6c080c92f31e8a55fe9934f452b | 536bb492d39bb6c080c92f31e8a55fe9934f452b |
| linux | linux | >= 5.15.105 < 5.15.145 | 5.15.145 |
| linux | linux | >= 51a8534c0f35c0401e45f1055f914729cad98bf9 < 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b | 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b |
| linux | linux | >= 6.1.22 < 6.1.53 | 6.1.53 |
| linux | linux | >= 6.2.9 < 6.3 | 6.3 |
| linux | linux_kernel | >= 0 < 6.1.55-1 | 6.1.55-1 |
| linux | linux_kernel | >= 0 < 6.5.3-1 | 6.5.3-1 |
| linux | linux_kernel | >= 0 < 6.5.3-1 | 6.5.3-1 |
| linux | linux_kernel | >= 0 < 5.15.0-102.112 | 5.15.0-102.112 |
| linux | linux_kernel | >= 5.15.0 < 5.15.145 | 5.15.145 |
| linux | linux_kernel | >= 5.16.0 < 6.1.53 | 6.1.53 |
| linux | linux_kernel | >= 6.2.0 < 6.4.16 | 6.4.16 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH
vendor_debian7.8HIGH
vendor_ubuntu7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-aws, linux-aws-5.15 vulnerabilities
osv·2024-04-16·CVSS 8.1
CVE-2023-1194 [HIGH] linux-aws, linux-aws-5.15 vulnerabilities
linux-aws, linux-aws-5.15 vulnerabilities
Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel
did not properly validate certain data structure fields when parsing lease
contexts, leading to an out-of-bounds read vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information. (CVE-2023-1194)
Quentin Minster discovered that a race condition existed in the KSMBD
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A remote attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-32254)
It was discovered that a race condition existed in the KSMBD implementation
in the Linux kernel when handling session connections, l
OSV
linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel
osv·2024-04-09·CVSS 8.1
[HIGH] linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel
linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities
Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel
did not properly validate certain data structure fields when parsing lease
contexts, leading to an out-of-bounds read vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information. (CVE-2023-1194)
Quentin Minster discovered that a race condition existed in the KSMBD
implementation in the L
GHSA
GHSA-x6xm-ghm9-28cr: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
If client send smb2 negotiate re
ghsa_unreviewed·2024-02-21
CVE-2023-52441 [HIGH] CWE-119 GHSA-x6xm-ghm9-28cr: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
If client send smb2 negotiate re
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.
OSV
CVE-2023-52441: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate requ
osv·2024-02-21·CVSS 7.8
CVE-2023-52441 [HIGH] CVE-2023-52441: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate requ
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false.
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2024-04-16·CVSS 7.1
CVE-2023-38427 [HIGH] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel
did not properly validate certain data structure fields when parsing lease
contexts, leading to an out-of-bounds read vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information. (CVE-2023-1194)
Quentin Minster discovered that a race condition existed in the KSMBD
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A remote attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-32254)
It was discovered that a race condition existed in the KSMBD imple
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-04-09·CVSS 7.1
CVE-2023-38427 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel
did not properly validate certain data structure fields when parsing lease
contexts, leading to an out-of-bounds read vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information. (CVE-2023-1194)
Quentin Minster discovered that a race condition existed in the KSMBD
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A remote attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-32254)
It was discovered that a race condition existed in the KSMBD implementat
Debian
CVE-2023-52441: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ...
vendor_debian·2023·CVSS 7.8
CVE-2023-52441 [HIGH] CVE-2023-52441: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ...
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false.
Scope: local
bookworm: resolved (fixed in 6.1.55-1)
bullseye: resolved
forky: resolved (fixed in 6.5.3-1)
sid: resolved (fixed in 6.5.3-1)
trixie: resolved (fixed in 6.5.3-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bchttps://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452bhttps://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40bhttps://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895fhttps://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bchttps://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452bhttps://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40bhttps://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f
2024-02-21
Published