← back
CVE-2023-52440

ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

EPSS 36.7%
In short

A buffer overflow vulnerability in ksmbd's NTLM authentication code allows an attacker to write more data than allocated when processing oversized session keys, potentially corrupting kernel memory.

Technical detail

CVE-2023-52440 is a heap buffer overflow in ksmbd_decode_ntlmssp_auth_blob() where insufficient validation of authblob->SessionKey.Length permits writing beyond the CIFS_KEY_SIZE buffer during ARC4 cipher operations. The vulnerability requires an attacker to control NTLM authentication messages sent to the SMB server, and can lead to kernel memory corruption or privilege escalation.

Summary generated and translated by AI from the official description.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.
Affected products
Linux · Linux

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →