CVE-2023-1194

What it actually does

An out-of-bounds memory read in parse_lease_state allows the create_context object to access invalid memory due to a missing NameOffset check when KSMBD processes a malformed CREATE command payload.

Why it matters to the business

Linux systems running the in-kernel SMB server may suffer information disclosure from kernel memory or denial of service crashes when exposed to untrusted network clients, increasing risk of data leaks or service outages on file servers.

How an attack unfolds

An attacker establishes an SMB session with a KSMBD-enabled Linux kernel and transmits a crafted CREATE command containing a malformed payload that omits proper NameOffset validation, causing parse_lease_state to dereference invalid memory and leak data or trigger a crash.

How to fix it

Upgrade the Linux kernel to a version containing commit d93fa2c78854d25ed4b67ac87f1c3c264d8b27fb; disable the ksmbd module if SMB server functionality is unnecessary.

How to confirm the fix worked

Confirm the running kernel source tree contains commit d93fa2c78854d25ed4b67ac87f1c3c264d8b27fb, or replay malformed CREATE packets in a test environment and verify absence of OOB memory access.

Typical attack path

1. Establish authenticated or guest SMB connection to the target KSMBD instance
2. Send a CREATE command with a deliberately malformed create_context payload
3. Trigger the missing NameOffset check in parse_lease_state
4. Read leaked kernel memory contents or force a kernel panic

How to detect it

Review kernel logs for ksmbd-related oops or warning messages indicating invalid memory access; inspect network captures for anomalous SMB CREATE commands with suspicious NameOffset values.

What your security team should do

• Apply the referenced kernel commit or distribution backport immediately on systems with ksmbd enabled
• Disable ksmbd via kernel configuration or module blacklist when SMB server capability is not required
• Restrict network exposure of KSMBD ports to trusted clients only