CVE-2023-52441 (GCVE-0-2023-52441)
Vulnerability from cvelistv5
Published
2024-02-21 07:21
Modified
2026-08-15 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 51a8534c0f35c0401e45f1055f914729cad98bf9 Version: 0b3ec5671ac06829ccebdaeec05acedfec327f42 Version: 39b291b86b5988bf8753c3874d5c773399d09b96 Version: 39b291b86b5988bf8753c3874d5c773399d09b96 Version: cc32cd98a0aee4cc3eb611cbce11795b1aaa738a Version: 5.15.105 ≤ Version: 6.1.22 ≤ Version: 6.2.9 ≤ |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:55:41.809Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-52441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:02:49.418159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:33:54.916Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/server.c",
"fs/smb/server/smb_common.c",
"fs/smb/server/smb_common.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b",
"status": "affected",
"version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
"versionType": "git"
},
{
"lessThan": "330d900620dfc9893011d725b3620cd2ee0bc2bc",
"status": "affected",
"version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
"versionType": "git"
},
{
"lessThan": "aa669ef229ae8dd779da9caa24e254964545895f",
"status": "affected",
"version": "39b291b86b5988bf8753c3874d5c773399d09b96",
"versionType": "git"
},
{
"lessThan": "536bb492d39bb6c080c92f31e8a55fe9934f452b",
"status": "affected",
"version": "39b291b86b5988bf8753c3874d5c773399d09b96",
"versionType": "git"
},
{
"status": "affected",
"version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
"versionType": "git"
},
{
"lessThan": "5.15.145",
"status": "affected",
"version": "5.15.105",
"versionType": "semver"
},
{
"lessThan": "6.1.53",
"status": "affected",
"version": "6.1.22",
"versionType": "semver"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/server.c",
"fs/smb/server/smb_common.c",
"fs/smb/server/smb_common.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.145",
"versionStartIncluding": "5.15.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.53",
"versionStartIncluding": "6.1.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\n\nIf client send smb2 negotiate request and then send smb1 negotiate\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\nneed_neg is set to false. This patch ignore smb1 packets after -\u003eneed_neg\nis set to false."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in ksmbd (fs/smb/server/), the in-kernel SMB server on TCP/445; init_smb2_rsp_hdr() runs while processing PDUs received from a remote peer via ksmbd_conn_handler_loop(), with no local access required.\nAC:L - The attacker reliably triggers the defect by sending an SMB2 negotiate (clearing need_neg) then an SMB1 negotiate on the same connection; both sides of the sequence and the small pdu_size that sizes the request slab object are fully attacker-controlled, with no race or external precondition.\nPR:N - The OOB occurs in init_rsp_hdr() during/after negotiate, before SESSION_SETUP and any credential check; smb2_check_user_session() does not require a session for negotiate, matching ZDI\u2019s unauthenticated assessment (ZDI-CAN-21541).\nUI:N - Exploitation needs only attacker-sent SMB negotiate PDUs to an already-running ksmbd listener; no local user or administrator action is required.\nS:U - The out-of-bounds read and leaked response data stay within the host kernel/ksmbd security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary cross.\nC:H - init_smb2_rsp_hdr() memcpy\u2019s 16 bytes of Signature (and copies SessionId/TreeId) from past the end of the attacker-sized SMB1 request buffer into the response, which ksmbd_conn_write() returns to the unauthenticated peer\u2014a groomable remote kernel-heap disclosure.\nI:N - The defect is a read past the request buffer; response writes stay inside the correctly allocated response buffer, so there is no out-of-bounds write or integrity/control-flow primitive from this bug alone.\nA:H - The overread past a tiny kmalloc request object can fault under KFENCE/DEBUG_PAGEALLOC or panic under KASAN/panic_on_warn (as in related KASAN reports), and the attacker can retrigger it pre-authentication at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T12:23:47.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
},
{
"url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
},
{
"url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
},
{
"url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
}
],
"title": "ksmbd: fix out of bounds in init_smb2_rsp_hdr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-52441",
"datePublished": "2024-02-21T07:21:01.075Z",
"dateReserved": "2024-02-20T12:30:33.291Z",
"dateUpdated": "2026-08-15T12:23:47.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T22:55:41.809Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52441\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:02:49.418159Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.575Z\"}}], \"cna\": {\"title\": \"ksmbd: fix out of bounds in init_smb2_rsp_hdr()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is in ksmbd (fs/smb/server/), the in-kernel SMB server on TCP/445; init_smb2_rsp_hdr() runs while processing PDUs received from a remote peer via ksmbd_conn_handler_loop(), with no local access required.\\nAC:L - The attacker reliably triggers the defect by sending an SMB2 negotiate (clearing need_neg) then an SMB1 negotiate on the same connection; both sides of the sequence and the small pdu_size that sizes the request slab object are fully attacker-controlled, with no race or external precondition.\\nPR:N - The OOB occurs in init_rsp_hdr() during/after negotiate, before SESSION_SETUP and any credential check; smb2_check_user_session() does not require a session for negotiate, matching ZDI\\u2019s unauthenticated assessment (ZDI-CAN-21541).\\nUI:N - Exploitation needs only attacker-sent SMB negotiate PDUs to an already-running ksmbd listener; no local user or administrator action is required.\\nS:U - The out-of-bounds read and leaked response data stay within the host kernel/ksmbd security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary cross.\\nC:H - init_smb2_rsp_hdr() memcpy\\u2019s 16 bytes of Signature (and copies SessionId/TreeId) from past the end of the attacker-sized SMB1 request buffer into the response, which ksmbd_conn_write() returns to the unauthenticated peer\\u2014a groomable remote kernel-heap disclosure.\\nI:N - The defect is a read past the request buffer; response writes stay inside the correctly allocated response buffer, so there is no out-of-bounds write or integrity/control-flow primitive from this bug alone.\\nA:H - The overread past a tiny kmalloc request object can fault under KFENCE/DEBUG_PAGEALLOC or panic under KASAN/panic_on_warn (as in related KASAN reports), and the attacker can retrigger it pre-authentication at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"51a8534c0f35c0401e45f1055f914729cad98bf9\", \"lessThan\": \"5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0b3ec5671ac06829ccebdaeec05acedfec327f42\", \"lessThan\": \"330d900620dfc9893011d725b3620cd2ee0bc2bc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39b291b86b5988bf8753c3874d5c773399d09b96\", \"lessThan\": \"aa669ef229ae8dd779da9caa24e254964545895f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39b291b86b5988bf8753c3874d5c773399d09b96\", \"lessThan\": \"536bb492d39bb6c080c92f31e8a55fe9934f452b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cc32cd98a0aee4cc3eb611cbce11795b1aaa738a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.105\", \"lessThan\": \"5.15.145\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.22\", \"lessThan\": \"6.1.53\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.2.9\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/smb/server/server.c\", \"fs/smb/server/smb_common.c\", \"fs/smb/server/smb_common.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.145\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.53\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.4.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/server/server.c\", \"fs/smb/server/smb_common.c\", \"fs/smb/server/smb_common.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b\"}, {\"url\": \"https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc\"}, {\"url\": \"https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f\"}, {\"url\": \"https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\\n\\nIf client send smb2 negotiate request and then send smb1 negotiate\\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\\nneed_neg is set to false. This patch ignore smb1 packets after -\u003eneed_neg\\nis set to false.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.145\", \"versionStartIncluding\": \"5.15.105\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.53\", \"versionStartIncluding\": \"6.1.22\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.4.16\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.2.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-15T12:23:47.601Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-52441\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-15T12:23:47.601Z\", \"dateReserved\": \"2024-02-20T12:30:33.291Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-21T07:21:01.075Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…