CVE Catalog
CVE-2023-38432
CriticalCVSS 9.1Exploitation Probability (EPSS)
High risk2.38%
82th percentile - higher than 82% of all known CVEs
Summary
An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, posing a risk of data leakage or system instability.
Recommendation
It is recommended to update the Linux kernel to version 6.3.10 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.