CVE-2023-52440

ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

State: Published
Severity: 9.8 Critical
Published: Feb 21, 2024
Updated: Aug 15, 2026
Reserved: Feb 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c5049d2d73b2dc8e6bb64be633250bad1ae3d9ef to before bd554ed4fdc3d38404a1c43d428432577573e809Affected f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before 30fd6521b2fbd9b767e438e31945e5ea3e3a2fbaAffected f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before 7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4Affected f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before ecd7e1c562cb08e41957fcd4b0e404de5ab38e20Affected f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before 4b081ce0d830b684fdf967abc3696d1261387254Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.52 through 6.1.Not affected 6.4.15 through 6.4.Not affected 6.5.2 through 6.5.*Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

c5049d2d73b2dc8e6bb64be633250bad1ae3d9ef to before bd554ed4fdc3d38404a1c43d428432577573e809Affected
f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before 30fd6521b2fbd9b767e438e31945e5ea3e3a2fbaAffected
f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before 7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4Affected
f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before ecd7e1c562cb08e41957fcd4b0e404de5ab38e20Affected
f9929ef6a2a55f03aac61248c6a3a987b8546f2a to before 4b081ce0d830b684fdf967abc3696d1261387254Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.52 through 6.1.*Not affected
6.4.15 through 6.4.*Not affected
6.5.2 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.