PT-2023-8716 · Linux+3 · Linux Kernel+3
CVE-2023-52440
·
Publicado
2023-08-29
·
Atualizado
2025-10-04
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux Kernel (affected versions not specified)
kernel-image-rpi-un version 6.1.77-alt1
Description
The Linux kernel contains a flaw within the ksmbd module, specifically in the
ksmbd decode ntlmssp auth blob() function. This issue relates to a heap-based buffer overflow that can occur during session key exchange. The problem arises when the SessionKey.Length within the authblob structure exceeds the expected CIFS KEY SIZE. This can lead to a slub overflow during key exchange operations, as the cifs arc4 crypt function copies data from the client's SessionKey into a session key array without proper size validation. Successful exploitation of this issue could allow a remote attacker to execute arbitrary code.Recommendations
For kernel-image-rpi-un version 6.1.77-alt1, update to the latest available version.
For all other affected Linux Kernel versions, update to the latest available version.
Exploit
Correção
Buffer Overflow
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Linux Kernel
Red Os