CVE-2023-39180: Linux Kernel ksmbd Read Request Memory Leak Denial-of-Service Vulnerability
A flaw was found within the handling of SMB2READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.
Other sources
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.
The specific flaw exists within the handling of SMB2READ commands. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
Reference: https://www.zerodayinitiative.com/advisories/ZDI-24-589/
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-39180?
CVE-2023-39180 has been classified as a high-severity vulnerability due to its potential to cause a denial-of-service condition.
How do I fix CVE-2023-39180?
To fix CVE-2023-39180, update your Linux kernel to a version that addresses this specific flaw in the ksmbd module.
What systems are affected by CVE-2023-39180?
CVE-2023-39180 affects installations of the Linux kernel that utilize the ksmbd module.
What kind of attack can exploit CVE-2023-39180?
CVE-2023-39180 can be exploited to create a denial-of-service condition on the affected systems.
Is authentication required to exploit CVE-2023-39180?
No, CVE-2023-39180 can be exploited without authentication, making it particularly dangerous.