PT-2025-54079 · Linux+1 · Linux Kernel+1

Published 2023-01-01 · Updated 2026-01-07 · CVE-2023-54250

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the ksmbd module related to out-of-bounds access in the decode preauth ctxt() function. The issue stems from insufficient boundary checks during the processing of SMB requests, specifically within the deassemble neg contexts() function. This function only verifies the SMB2 negotiation context header and the client-controlled DataLength against the packet boundary, which is inadequate. The vulnerability could be triggered when accessing the HashAlgorithms address within the pneg ctxt structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-54250

Affected Products

Debian

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54250.json · Exploit
• https://ubuntu.com/security/CVE-2023-54250 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-54250 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-54250 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54250 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-54250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-54250 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-54250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-54250 · Vendor Advisory
• https://git.kernel.org/linus/e7067a446264a7514fa1cfaa4052cdb6803bc6a2 · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-54250 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001 · Note
• https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2 · Note
• https://twitter.com/CVEnew/status/2005993862943359034 · Twitter Post