CVE-2023-52442

MEDIUM

Linux Kernel - Session and Tree ID Validation Bypass in ksmbd

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

References (4)

Core 4

Scores

CVSS v3 5.5
EPSS 0.1744
EPSS Percentile 96.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (15)
linux/Kernel 5.15.0 - 5.15.145linux
linux/Kernel 5.16.0 - 6.1.53linux
linux/Kernel 6.2.0 - 6.4.16linux
Linux/Linux < 5.15
Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 017d85c94f02090a87f4a473dbe0d6ee0da72693
Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 3df0411e132ee74a87aa13142dfd2b190275332e
Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 4c2b350b2e269e3fd17bbfa42de1b42775b777ac
Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - becb5191d1d5fdfca0198a2e37457bbbf4fe266f
Linux/Linux 5.15
Linux/Linux 5.15.145 - 5.15.*
... and 5 more
Published Feb 21, 2024
Tracked Since Feb 18, 2026