CVE-2023-38427: Integer Underflow
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemblenegcontexts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernel (ksmbd)to a version that resolves this vulnerability.Fixed in 6.3.8 - Compensating control
If you cannot upgrade immediately, mitigate by disabling the ksmbd SMB server component until you can apply the fix (since the issue is in fs/smb/server/smb2pdu.c in ksmbd).
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38427?
CVE-2023-38427 is classified as a medium-level vulnerability with potential impact on affected systems.
How do I fix CVE-2023-38427?
To fix CVE-2023-38427, update your Linux kernel to version 6.3.9 or later, or one of the patched versions specified in your distribution's advisory.
Which software is affected by CVE-2023-38427?
CVE-2023-38427 affects various versions of the Linux kernel prior to 6.3.8 and specific NetApp hardware like the H300s, H410s, H500s, and H700s.
What is the nature of the vulnerability in CVE-2023-38427?
CVE-2023-38427 involves an integer underflow and out-of-bounds read in the Linux kernel's ksmbd component.
When was CVE-2023-38427 last updated?
CVE-2023-38427 was last updated on 29 November 2024.