CVEvulnerability
CVE-2023-54250
8.2 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2025-12-30
- Last modified
- 2026-08-04
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- CVSS 3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: avoid out of bounds access in decode_preauth_ctxt()
Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within
the SMB request boundary; deassemble_neg_contexts() only checks that the
eight byte smb2_neg_context header + (client controlled) DataLength are
within the packet boundary, which is insufficient.
Checking for sizeof(struct smb2_preauth_neg_context) is overkill given
that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.
References
- https://git.kernel.org/stable/c/39f5b4b313b445c980a2a295bed28228c29228ed git.kernel.org
- https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001 git.kernel.org
- https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2 git.kernel.org
- https://git.kernel.org/stable/c/f02edb9debbd36f44efa7567031485892c7df60d git.kernel.org