PT-2023-3668 · Linux+5 · Linux Kernel+5

Chih-Yen Chang · Published 2023-06-02 · Updated 2025-01-13 · CVE-2023-38431

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.8

Description An issue in the Linux kernel's ksmbd module, specifically in the fs/smb/server/connection.c file, does not validate the relationship between the NetBIOS header's length field and the SMB header sizes. This can lead to an out-of-bounds read via the pdu size in the ksmbd conn handler loop function, potentially allowing an attacker to access protected information or cause a denial of service.

Recommendations For Linux kernel versions prior to 6.3.8, update to version 6.3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the ksmbd module to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-4663

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-27539

BDU:2023-03952

CVE-2023-38431

ROSA-SA-2023-2208

USN-6412-1

USN-6466-1

USN-6725-1

USN-6725-2

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 119

• https://ubuntu.com/security/CVE-2023-52340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3863 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52448 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26591 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4155 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52438 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52443 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45919 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6466-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4132 · Vendor Advisory