CVE-2023-52441
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In the Linux kernel, the ksmbd module has an out-of-bounds access in init_smb2_rsp_hdr(). If a client sends an SMB2 negotiate request and then an SMB1 negotiate request, the function is called for the SMB1 request, leading to an issue. The fix ignores SMB1 packets after need_neg is set to false.
Risk Assessment
The vulnerability may lead to out-of-bounds memory access, potentially causing system crashes or privilege escalation in the SMB service.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2023-52441.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false.