CVE-2023-54203

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr

When smb1 mount fails, KASAN detect slab-out-of-bounds in

init_smb2_rsp_hdr like the following one.

For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called.

The issue occurs while handling smb1 negotiate as smb2 server operations.

Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr,

allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that

smb2 server operation does not handle it.

[ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is

not recommended unless required for access to very old servers

[ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes

[ 411.479312] ksmbd: init_smb2_rsp_hdr : 492

[ 411.479323] ==================================================================

[ 411.479327] BUG: KASAN: slab-out-of-bounds in

init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]

[ 411.479369] Read of size 16 at addr ffff8884

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References