ksmbd: validate session id and tree id in compound request
Summary
| CVE | CVE-2023-52442 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-02-21 08:15:45 UTC |
| Updated | 2026-08-04 10:18:27 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Problem Types: NVD-CWE-noinfo | CWE-noinfo Not enough information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ADP | DECLARED | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | DECLARED | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 0626e6641f6b467447c81dd7678a69c66f7746cf 017d85c94f02090a87f4a473dbe0d6ee0da72693 git | Not specified |
| CNA | Linux | Linux | affected 0626e6641f6b467447c81dd7678a69c66f7746cf becb5191d1d5fdfca0198a2e37457bbbf4fe266f git | Not specified |
| CNA | Linux | Linux | affected 0626e6641f6b467447c81dd7678a69c66f7746cf 4c2b350b2e269e3fd17bbfa42de1b42775b777ac git | Not specified |
| CNA | Linux | Linux | affected 0626e6641f6b467447c81dd7678a69c66f7746cf 3df0411e132ee74a87aa13142dfd2b190275332e git | Not specified |
| CNA | Linux | Linux | affected 5.15 | Not specified |
| CNA | Linux | Linux | unaffected 5.15 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.145 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.53 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.4.16 6.4.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.5 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 200243 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6725-1)