Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2023-54250

ksmbd: avoid out of bounds access in decode_preauth_ctxt()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: avoid out of bounds access in decode_preauth_ctxt() Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient. Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 39f5b4b313b445c980a2a295bed28228c29228edaffected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < a2f6ded41bec1d3be643c80a5eb97f1680309001affected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < f02edb9debbd36f44efa7567031485892c7df60daffected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < e7067a446264a7514fa1cfaa4052cdb6803bc6a2affected

Linux Linux

Default version status: affected

  • 5.15affected
  • 0 to < 5.15unaffected
  • 5.15.145 to ≤ 5.15.*unaffected
  • 6.1.25 to ≤ 6.1.*unaffected
  • 6.2.12 to ≤ 6.2.*unaffected
  • 6.3 to ≤ *unaffected

References