CVE-2023-3867: Linux Kernel ksmbd Session Setup Out-Of-Bounds Read Information Disclosure Vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out of bounds read in smb2sesssetup
ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2sesssetup().
Other sources
ksmbd: add missing compound request handing in some commands
— Debian
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The specific flaw exists within the handling of session setup commands. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3867?
CVE-2023-3867 has a high severity rating due to its ability to allow remote attackers to disclose sensitive information without authentication.
How do I fix CVE-2023-3867?
To fix CVE-2023-3867, update your Linux Kernel to the recommended patched versions, including 5.10.223-1 or 6.12.11-1.
What systems are affected by CVE-2023-3867?
CVE-2023-3867 affects various installations of the Linux Kernel, specifically those listed under the defined versions.
Is authentication required to exploit CVE-2023-3867?
No, authentication is not required to exploit CVE-2023-3867, making it easier for remote attackers to initiate an attack.
What kind of information can be disclosed by exploiting CVE-2023-3867?
Exploiting CVE-2023-3867 can allow attackers to disclose sensitive information from affected Linux Kernel installations.