CVE-2023-38429: Critical severity Linux Linux kernel vulnerability

Q: What is the severity of CVE-2023-38429?

CVE-2023-38429 has a medium severity rating due to the potential for out-of-bounds access caused by an off-by-one error in memory allocation.

Q: What versions of the Linux kernel are affected by CVE-2023-38429?

CVE-2023-38429 affects Linux kernel versions prior to 6.3.4, specifically versions 5.15 to 5.15.113, 5.16 to 6.1.30, and 6.2 to 6.3.4.

Q: How do I fix CVE-2023-38429?

To fix CVE-2023-38429, upgrade the Linux kernel to version 6.3.4 or later, or the specified remedial versions for earlier kernels.

Q: What type of vulnerability is CVE-2023-38429?

CVE-2023-38429 is a memory corruption vulnerability due to an off-by-one error in the Linux kernel's ksmbd module.

Q: Can CVE-2023-38429 lead to exploitation by attackers?

Yes, CVE-2023-38429 can potentially allow attackers to exploit the vulnerability for unauthorized access or system crashes due to out-of-bounds memory access.

Published Jul 17, 2023

Updated

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbdsmb2checkmessage) that may lead to out-of-bounds access.

Affected Software

97 affected componentsFixes available

Linux Linux kernel<6.3.4

Linux Linux kernel>=5.15<5.15.113

Linux Linux kernel>=5.16<6.1.30

Linux Linux kernel>=6.2<6.3.4

debian/linux

5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.15<5.15.0-1044.49~20.04.1

5.15.0-1044.49~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1046.53~20.04.1

5.15.0-1046.53~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1041.49~20.04.1

5.15.0-1041.49~20.04.1

ubuntu/linux-gkeop-5.15<5.15.0-1027.32~20.04.1

5.15.0-1027.32~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-83.92~20.04.1

5.15.0-83.92~20.04.1

ubuntu/linux-ibm-5.15<5.15.0-1037.40~20.04.1

5.15.0-1037.40~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1040.46~20.04.1

5.15.0-1040.46~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-83.92~20.04.1

5.15.0-83.92~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1017.17~20.04.1

5.15.0-1017.17~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1042.48~20.04.1

5.15.0-1042.48~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1040.44~20.04.3

5.15.0-1040.44~20.04.3

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-83.92

5.15.0-83.92

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1044.49

5.15.0-1044.49

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2<6.2.0-1011.11~22.04.1

6.2.0-1011.11~22.04.1

ubuntu/linux-azure<5.15.0-1046.53

5.15.0-1046.53

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-fde<5.15.0-1046.53.1

5.15.0-1046.53.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-gcp<5.15.0-1041.49

5.15.0-1041.49

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2<6.2.0-1013.13~22.04.1

6.2.0-1013.13~22.04.1

ubuntu/linux-gke<5.15.0-1041.46

5.15.0-1041.46

ubuntu/linux-gkeop<5.15.0-1027.32

5.15.0-1027.32

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2<6.2.0-32.32~22.04.1

6.2.0-32.32~22.04.1

ubuntu/linux-ibm<5.15.0-1037.40

5.15.0-1037.40

ubuntu/linux-intel-iotg<5.15.0-1039.45

5.15.0-1039.45

ubuntu/linux-kvm<5.15.0-1041.46

5.15.0-1041.46

ubuntu/linux-lowlatency<5.15.0-83.92

5.15.0-83.92

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2<6.2.0-1012.12~22.04.1

6.2.0-1012.12~22.04.1

ubuntu/linux-nvidia<5.15.0-1032.32

5.15.0-1032.32

ubuntu/linux-nvidia-6.2<6.2.0-1010.10

6.2.0-1010.10

ubuntu/linux-nvidia-tegra<5.15.0-1017.17

5.15.0-1017.17

ubuntu/linux-nvidia-tegra-igx<5.15.0-1004.4

5.15.0-1004.4

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1<6.1.0-1016.16

6.1.0-1016.16

ubuntu/linux-oracle<5.15.0-1042.48

5.15.0-1042.48

ubuntu/linux-raspi<5.15.0-1037.40

5.15.0-1037.40

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-xilinx-zynqmp<5.15.0-1025.29

5.15.0-1025.29

ubuntu/linux-bluefield<5.15.0-1023.25

5.15.0-1023.25

ubuntu/linux-intel-iot-realtime<5.15.0-1038.40

5.15.0-1038.40

ubuntu/linux-realtime<5.15.0-1045.50

5.15.0-1045.50

ubuntu/linux-fips*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.49~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.53~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.49~20.04.1
Upgrade
Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.32~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-83.92~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1037.40~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1040.46~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-83.92~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.17~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1042.48~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1040.44~20.04.3
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-83.92
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.49
Upgrade
Upgrade ubuntu/linux-aws-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1011.11~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.53
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.53.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.49
Upgrade
Upgrade ubuntu/linux-gcp-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1013.13~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.46
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.32
Upgrade
Upgrade ubuntu/linux-hwe-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-32.32~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1037.40
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1039.45
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.46
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-83.92
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1012.12~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1032.32
Upgrade
Upgrade ubuntu/linux-nvidia-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1010.10
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.17
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1004.4
Upgrade
Upgrade ubuntu/linux-oem-6.1 to a version that resolves this vulnerability.
Fixed in 6.1.0-1016.16
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1042.48
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1037.40
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.29
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.25
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1038.40
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.50
Upgrade
Upgrade Linux kernel ksmbd to a version that resolves this vulnerability.
Fixed in 6.3.4

Event History

Jul 17, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Jul 18, 2023

Data Sourced

12:15 AM

Description

Data Sourced

via OSV·12:15 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-38429?

CVE-2023-38429 has a medium severity rating due to the potential for out-of-bounds access caused by an off-by-one error in memory allocation.

What versions of the Linux kernel are affected by CVE-2023-38429?

CVE-2023-38429 affects Linux kernel versions prior to 6.3.4, specifically versions 5.15 to 5.15.113, 5.16 to 6.1.30, and 6.2 to 6.3.4.

How do I fix CVE-2023-38429?

To fix CVE-2023-38429, upgrade the Linux kernel to version 6.3.4 or later, or the specified remedial versions for earlier kernels.

What type of vulnerability is CVE-2023-38429?

CVE-2023-38429 is a memory corruption vulnerability due to an off-by-one error in the Linux kernel's ksmbd module.

Can CVE-2023-38429 lead to exploitation by attackers?

Yes, CVE-2023-38429 can potentially allow attackers to exploit the vulnerability for unauthorized access or system crashes due to out-of-bounds memory access.

CVE-2023-38429: Critical severity Linux Linux kernel vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2023-38429?

What versions of the Linux kernel are affected by CVE-2023-38429?

How do I fix CVE-2023-38429?

What type of vulnerability is CVE-2023-38429?

Can CVE-2023-38429 lead to exploitation by attackers?

Company

Resources

Contact