CVE Catalog
CVE-2023-38426
CriticalCVSS 9.1Exploitation Probability (EPSS)
High risk2.44%
82th percentile - higher than 82% of all known CVEs
Summary
An issue was discovered in the Linux kernel before version 6.3.4 related to an out-of-bounds read in smb2_find_context_vals. This occurs when the name_len of create_context is larger than the tag length.
Risk Assessment
An attacker may exploit this vulnerability to read data outside the allocated memory space, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to update the Linux kernel to version 6.3.4 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.