CVE-2023-52442

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52442
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 Patch
https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e Patch
https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac Patch
https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f Patch
https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 Patch
https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e Patch
https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac Patch
https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*
History

12 Dec 2024, 15:31

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 - () https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 - Patch
References () https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e - () https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e - Patch
References () https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac - () https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac - Patch
References () https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f - () https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 08:39

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 - () https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 -
References () https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e - () https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e -
References () https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac - () https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac -
References () https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f - () https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f -

28 May 2024, 20:16

Type Values Removed Values Added
References
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/03/18/2', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/18/2 -

22 Feb 2024, 19:07

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ksmbd: validar la identificación de la sesión y la identificación del árbol en la solicitud compuesta `smb2_get_msg()` en smb2_get_ksmbd_tcon() y smb2_check_user_session() siempre devolverá el encabezado smb2 de la primera solicitud en una solicitud compuesta. si `SMB2_TREE_CONNECT_HE` es el primer comando en la solicitud compuesta, devolverá 0, es decir, se omite la verificación de identificación del árbol. Este parche usa ksmbd_req_buf_next() para obtener el comando actual en compuesto.

21 Feb 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-21 08:15

Updated : 2024-12-12 15:31

NVD link : CVE-2023-52442

Mitre link : CVE-2023-52442

CVE.ORG link : CVE-2023-52442

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo