CRITICAL Introduced in 6.3
ksmbd SMB1Negotiate OOB
CVE-2023-54203
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI9.1CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it. [ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes [ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 [ 411.479323] ================================================================== [ 411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 [ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE 6.1.21 #3 [ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 411.479425] Call Trace: [ 411.479428] <TASK> [ 411.479432] dump_stack_lvl+0x49/0x63 [ 411.479444] print_report+0x171/0x4a8 [ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 [ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479497] kasan_report+0xb4/0x130 [ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479537] kasan_check_range+0x149/0x1e0 [ 411.479543] memcpy+0x24/0x70 [ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd] [ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50 [ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd] [ 411.479656] process_one_work+0x49c/0x790 [ 411.479667] worker_thread+0x2b1/0x6e0 [ 411.479674] ? process_one_work+0x790/0x790 [ 411.479680] kthread+0x177/0x1b0 [ 411.479686] ? kthread_complete_and_exit+0x30/0x30 [ 411.479692] ret_from_fork+0x22/0x30 [ 411.479702] </TASK>
02KernelScan AI Analysis
Risk summary
An unauthenticated remote client that can reach an enabled ksmbd SMB service can send a legacy SMB1 negotiation packet and trigger a heap over-read before login. The read is fixed at 16 bytes, so the demonstrated risk is limited disclosure of neighboring kernel-heap data rather than arbitrary corruption or code execution.
Vulnerability analysis
ksmbd chose SMB2 response handling during early negotiation without first distinguishing an SMB1 request. The shorter SMB1 packet therefore did not satisfy the fixed-size data assumptions of that path, allowing response construction to copy past the end of the received request; the fix now selects protocol-specific handling from the request's declared wire protocol and uses a bounded SMB1 negotiation response. Any unauthenticated remote client able to connect to an enabled ksmbd SMB service can send this legacy request; no account, user-namespace capability, special hardware, or prior authentication is required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.105 | 5.15.145 | 921536046bd1 |
| 6.1 | 6.1.22 | 6.1.24 | a8334a0c535d |
| 6.2 | 6.2.9 | 6.2.11 | 99a51c673b1d |
| cip/6.1 | 6.3 | 6.1.38-cip1 | a8334a0c535d |
| cip/6.1-rt | 6.3 | 6.1.38-cip1-rt1 | a8334a0c535d |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.1 | Fixed in 6.1.38-cip1 |
| cip/6.1-rt | Fixed in 6.1.38-cip1-rt1 |