CVE-2023-3865: Linux Kernel ksmbd Out-Of-Bounds Read Information Disclosure Vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bound read in smb2write
ksmbdsmb2checkmessage doesn't validate hdr->NextCommand. If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow oversized smb2 write length. It will cause OOB read in smb2write.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Furthermore, only systems with ksmbd enabled are vulnerable. The specific flaw exists within the parsing of smb2hdr structure. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Compensating control
Since only systems with ksmbd enabled are vulnerable, ensure ksmbd is disabled on systems where it is not required.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3865?
CVE-2023-3865 has been classified with a moderate severity rating due to its ability to allow remote attackers to disclose sensitive information.
How do I fix CVE-2023-3865?
To fix CVE-2023-3865, update to one of the patched versions of the Linux Kernel such as 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Who is affected by CVE-2023-3865?
CVE-2023-3865 affects installations of the Linux Kernel that are running vulnerable versions.
Is authentication required to exploit CVE-2023-3865?
Authentication may or may not be required depending on the specific installation and configuration when exploiting CVE-2023-3865.
What type of vulnerability is CVE-2023-3865?
CVE-2023-3865 is an out-of-bounds read vulnerability that can lead to the disclosure of sensitive information.