CVE-2023-54203
Slab-Out-of-Bounds in Linux ksmbd init_smb2_rsp_hdr Function
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a slab-out-of-bounds error in the Linux kernel's ksmbd component, specifically in the init_smb2_rsp_hdr function. It occurs when an SMB1 mount fails and the system incorrectly calls SMB2 response header initialization for an SMB1 negotiate request. This mismatch leads to out-of-bounds memory access detected by KASAN (Kernel Address Sanitizer). The fix involves adding proper SMB1 server operations to handle SMB1 negotiate requests separately, preventing SMB2 operations from handling them incorrectly.
How can this vulnerability impact me? :
This vulnerability can cause out-of-bounds memory access in the Linux kernel, which may lead to system instability, crashes, or potential security risks such as memory corruption. Exploiting this could allow an attacker to cause denial of service or possibly execute arbitrary code with kernel privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be done by monitoring kernel logs for KASAN slab-out-of-bounds errors related to init_smb2_rsp_hdr in the ksmbd module. For example, using the command `dmesg | grep ksmbd` or `journalctl -k | grep ksmbd` to look for messages similar to 'BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr'.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the ksmbd slab-out-of-bounds issue in init_smb2_rsp_hdr is fixed. Additionally, avoid using the SMB1 protocol (dialect vers=1.0) as it is less secure and related to the issue.