CVE-2023-4515 (GCVE-0-2023-4515)
Vulnerability from cvelistv5
Published
2025-08-16 13:25
Modified
2026-08-05 09:09
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands.
References
Impacted products
Vendor Product Version
Linux Linux Version: 35f450f54dca1519bb24faacd0428db09f89a11f
Version: 9650cf70ec9d94ff34daa088b643229231723c26
Version: 2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d
Version: 2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d
Version: 768caf4019f0391c0b6452afe34cea1704133f7b
Version: 5.15.121   ≤
Version: 6.1.36   ≤
Version: 6.3.10   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "595679098bdcdbfbba91ebe07a2f7f208df93870",
              "status": "affected",
              "version": "35f450f54dca1519bb24faacd0428db09f89a11f",
              "versionType": "git"
            },
            {
              "lessThan": "c6bef3bc30fd4a175aef846b7d928a6c40d091cd",
              "status": "affected",
              "version": "9650cf70ec9d94ff34daa088b643229231723c26",
              "versionType": "git"
            },
            {
              "lessThan": "ff7236b66d69582f90cf5616e63cfc3dc18142bb",
              "status": "affected",
              "version": "2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d",
              "versionType": "git"
            },
            {
              "lessThan": "5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c",
              "status": "affected",
              "version": "2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "768caf4019f0391c0b6452afe34cea1704133f7b",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.127",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.46",
              "status": "affected",
              "version": "6.1.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.127",
                  "versionStartIncluding": "5.15.121",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.46",
                  "versionStartIncluding": "6.1.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.11",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate command request size\n\nIn commit 2b9b8f3b68ed (\"ksmbd: validate command payload size\"), except\nfor SMB2_OPLOCK_BREAK_HE command, the request size of other commands\nis not checked, it\u0027s not expected. Fix it by add check for request\nsize of other commands."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in ksmbd (fs/smb/server/), the in-kernel SMB server reached over TCP/445; a remote peer triggers it by sending a crafted SMB2 PDU that fails StructureSize2 validation.\nAC:L - An attacker fully controls StructureSize2 and the RFC1002 PDU length and can reliably send a short pre-auth SESSION_SETUP (e.g. StructureSize2=1 with pdu_size=68) that passes the incomplete check and OOBs in smb2_get_data_area_len; no race or external condition is required.\nPR:N - ksmbd_smb2_check_message runs for SMB2_NEGOTIATE, SMB2_SESSION_SETUP, and SMB2_ECHO, which smb2_check_user_session explicitly allows without a session, so the OOB is reachable before any credential verification.\nUI:N - Exploitation requires only attacker-sent SMB2 packets to a listening ksmbd instance; no victim user action is needed.\nS:U - Impact stays within the host kernel/ksmbd security authority (heap OOB read/DoS); this is not a VM escape, IOMMU bypass, or other cross-authority boundary change.\nC:H - Missing StructureSize2 matching allows slab out-of-bounds reads of fixed command fields (and subsequent use of those values as security-blob offset/length), which can disclose adjacent kernel heap contents under standard grooming; per guidance OOB reads score C:H.\nI:N - The defect is an out-of-bounds read from incomplete request-size validation; unlike related ksmbd heap overflows there is no demonstrated out-of-bounds write or direct integrity/control-flow primitive from this bug alone.\nA:H - The slab OOB read can fault under KFENCE/DEBUG_PAGEALLOC or panic under KASAN (as in the related KASAN report for the incomplete parent fix), and the attacker can retrigger it pre-authentication at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:09:51.240Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/595679098bdcdbfbba91ebe07a2f7f208df93870"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6bef3bc30fd4a175aef846b7d928a6c40d091cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff7236b66d69582f90cf5616e63cfc3dc18142bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c"
        }
      ],
      "title": "ksmbd: validate command request size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-4515",
    "datePublished": "2025-08-16T13:25:50.562Z",
    "dateReserved": "2023-08-24T10:34:48.702Z",
    "dateUpdated": "2026-08-05T09:09:51.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.