FKIE_CVE-2023-54203

Vulnerability from fkie_nvd - Published: 2025-12-30 13:16 - Updated: 2026-10-28 19:10
Severity
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it. [ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes [ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 [ 411.479323] ================================================================== [ 411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 [ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE 6.1.21 #3 [ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 411.479425] Call Trace: [ 411.479428] <TASK> [ 411.479432] dump_stack_lvl+0x49/0x63 [ 411.479444] print_report+0x171/0x4a8 [ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 [ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479497] kasan_report+0xb4/0x130 [ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479537] kasan_check_range+0x149/0x1e0 [ 411.479543] memcpy+0x24/0x70 [ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd] [ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50 [ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd] [ 411.479656] process_one_work+0x49c/0x790 [ 411.479667] worker_thread+0x2b1/0x6e0 [ 411.479674] ? process_one_work+0x790/0x790 [ 411.479680] kthread+0x177/0x1b0 [ 411.479686] ? kthread_complete_and_exit+0x30/0x30 [ 411.479692] ret_from_fork+0x22/0x30 [ 411.479702] </TASK>
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/921536046bd165efeb07beef5630aff35cd6a489
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/99a51c673b1d2d0b5a972353401b77612d9cc713
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a8334a0c535d0f0b4d64926c8fe0922ed98f7d43
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dc8289f912387c3bcfbc5d2db29c8947fa207c11
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/server.c",
            "fs/ksmbd/smb2pdu.c",
            "fs/ksmbd/smb_common.c",
            "fs/ksmbd/smb_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "921536046bd165efeb07beef5630aff35cd6a489",
              "status": "affected",
              "version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
              "versionType": "git"
            },
            {
              "lessThan": "a8334a0c535d0f0b4d64926c8fe0922ed98f7d43",
              "status": "affected",
              "version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
              "versionType": "git"
            },
            {
              "lessThan": "99a51c673b1d2d0b5a972353401b77612d9cc713",
              "status": "affected",
              "version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
              "versionType": "git"
            },
            {
              "lessThan": "dc8289f912387c3bcfbc5d2db29c8947fa207c11",
              "status": "affected",
              "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/server.c",
            "fs/ksmbd/smb2pdu.c",
            "fs/ksmbd/smb_common.c",
            "fs/ksmbd/smb_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.145",
              "status": "affected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.24",
              "status": "affected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.11",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr\n\nWhen smb1 mount fails, KASAN detect slab-out-of-bounds in\ninit_smb2_rsp_hdr like the following one.\nFor smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called.\nThe issue occurs while handling smb1 negotiate as smb2 server operations.\nAdd smb server operations for smb1 (get_cmd_val, init_rsp_hdr,\nallocate_rsp_buf, check_user_session) to handle smb1 negotiate so that\nsmb2 server operation does not handle it.\n\n[  411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is\nnot recommended unless required for access to very old servers\n[  411.400452] CIFS: Attempting to mount \\\\192.168.45.139\\homes\n[  411.479312] ksmbd: init_smb2_rsp_hdr : 492\n[  411.479323] ==================================================================\n[  411.479327] BUG: KASAN: slab-out-of-bounds in\ninit_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199\n\n[  411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G\n OE      6.1.21 #3\n[  411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8\nSeries/Z10PA-D8 Series, BIOS 3801 08/23/2019\n[  411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]\n[  411.479425] Call Trace:\n[  411.479428]  \u003cTASK\u003e\n[  411.479432]  dump_stack_lvl+0x49/0x63\n[  411.479444]  print_report+0x171/0x4a8\n[  411.479452]  ? kasan_complete_mode_report_info+0x3c/0x200\n[  411.479463]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479497]  kasan_report+0xb4/0x130\n[  411.479503]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479537]  kasan_check_range+0x149/0x1e0\n[  411.479543]  memcpy+0x24/0x70\n[  411.479550]  init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479585]  handle_ksmbd_work+0x109/0x760 [ksmbd]\n[  411.479616]  ? _raw_spin_unlock_irqrestore+0x50/0x50\n[  411.479624]  ? smb3_encrypt_resp+0x340/0x340 [ksmbd]\n[  411.479656]  process_one_work+0x49c/0x790\n[  411.479667]  worker_thread+0x2b1/0x6e0\n[  411.479674]  ? process_one_work+0x790/0x790\n[  411.479680]  kthread+0x177/0x1b0\n[  411.479686]  ? kthread_complete_and_exit+0x30/0x30\n[  411.479692]  ret_from_fork+0x22/0x30\n[  411.479702]  \u003c/TASK\u003e"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corregir slab fuera de l\u00edmites en init_smb2_rsp_hdr\n\nCuando el montaje smb1 falla, KASAN detecta slab fuera de l\u00edmites en init_smb2_rsp_hdr como el siguiente.\nPara la negociaci\u00f3n smb1 (56bytes), se llama a init_smb2_rsp_hdr() para smb2.\nEl problema ocurre al manejar la negociaci\u00f3n smb1 como operaciones de servidor smb2.\nA\u00f1adir operaciones de servidor smb para smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) para manejar la negociaci\u00f3n smb1 de modo que la operaci\u00f3n de servidor smb2 no la maneje.\n\n[  411.400423] CIFS: VFS: No se recomienda el uso del dialecto menos seguro vers=1.0 a menos que sea necesario para el acceso a servidores muy antiguos\n[  411.400452] CIFS: Intentando montar \\\\192.168.45.139\\homes\n[  411.479312] ksmbd: init_smb2_rsp_hdr : 492\n[  411.479323] ==================================================================\n[  411.479327] BUG: KASAN: slab fuera de l\u00edmites en init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479369] Lectura de tama\u00f1o 16 en la direcci\u00f3n ffff888488ed0734 por la tarea kworker/14:1/199\n\n[  411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE      6.1.21 #3\n[  411.479386] Nombre del hardware: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019\n[  411.479390] Cola de trabajo: ksmbd-io handle_ksmbd_work [ksmbd]\n[  411.479425] Traza de llamada:\n[  411.479428] [TAREA]\n[  411.479432] dump_stack_lvl+0x49/0x63\n[  411.479444] print_report+0x171/0x4a8\n[  411.479452] ? kasan_complete_mode_report_info+0x3c/0x200\n[  411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479497] kasan_report+0xb4/0x130\n[  411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479537] kasan_check_range+0x149/0x1e0\n[  411.479543] memcpy+0x24/0x70\n[  411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd]\n[  411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50\n[  411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd]\n[  411.479656] process_one_work+0x49c/0x790\n[  411.479667] worker_thread+0x2b1/0x6e0\n[  411.479674] ? process_one_work+0x790/0x790\n[  411.479680] kthread+0x177/0x1b0\n[  411.479686] ? kthread_complete_and_exit+0x30/0x30\n[  411.479692] ret_from_fork+0x22/0x30\n[  411.479702] [/TAREA]"
    }
  ],
  "id": "CVE-2023-54203",
  "lastModified": "2026-10-28T19:10:00.193",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-30T13:16:08.420",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/921536046bd165efeb07beef5630aff35cd6a489"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/99a51c673b1d2d0b5a972353401b77612d9cc713"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a8334a0c535d0f0b4d64926c8fe0922ed98f7d43"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dc8289f912387c3bcfbc5d2db29c8947fa207c11"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.