CVE-2023-3866: Linux Kernel ksmbd Chained Request NULL Pointer Dereference Denial-of-Service Vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate session id and tree id in the compound request
This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error.
Other sources
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. The specific flaw exists within the handling of chained requests. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernel ksmbdto a version that resolves this vulnerability.Patch ksmbd: validate session id and tree id in the compound request - Configuration
Disable ksmbd (only systems with ksmbd enabled are vulnerable).
Linux kernel ksmbd ksmbd enabled = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3866?
CVE-2023-3866 is rated as a high severity vulnerability due to its potential to cause a denial-of-service condition.
How does CVE-2023-3866 affect Linux Kernel installations?
CVE-2023-3866 allows remote attackers to exploit the vulnerability without authentication, leading to service disruption.
What versions of Linux Kernel are affected by CVE-2023-3866?
CVE-2023-3866 affects specific versions of the Linux Kernel, including versions 5.10.223-1, 5.10.226-1, 6.1.119-1, and 6.12.11-1.
How can I remediate CVE-2023-3866?
To fix CVE-2023-3866, users should upgrade to the latest patched version of the Linux Kernel provided by their distribution.
Is authentication required to exploit CVE-2023-3866?
No, authentication is not required to exploit CVE-2023-3866, making it particularly critical for affected systems.