Riskcovery

CVE-2023-52442

ksmbd: validate session id and tree id in compound request

State
Published
Severity
9.1 Critical
Published
Feb 21, 2024
Updated
Aug 5, 2026
Reserved
Feb 20, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate session id and tree id in compound request

`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HLinux
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 017d85c94f02090a87f4a473dbe0d6ee0da72693Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before becb5191d1d5fdfca0198a2e37457bbbf4fe266fAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 4c2b350b2e269e3fd17bbfa42de1b42775b777acAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 3df0411e132ee74a87aa13142dfd2b190275332eAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.145 through 5.15.*Not affected
  • 6.1.53 through 6.1.*Not affected
  • 6.4.16 through 6.4.*Not affected
  • 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.