CVE-2023-38428

What it actually does

Out-of-bounds read in fs/ksmbd/smb2pdu.c caused by failure to validate UserName against the security buffer address, resulting in memory corruption.

Why it matters to the business

Remote attackers may read kernel memory contents or cause denial of service on Linux servers exposing ksmbd file sharing, potentially leading to data leakage or service disruption across affected deployments.

How an attack unfolds

An unauthenticated attacker sends a crafted SMB2 PDU containing a malicious UserName value that bypasses security buffer address checks, triggering an out-of-bounds read in the ksmbd kernel module.

How to fix it

Update the Linux kernel to a version containing commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed or later; rebuild and deploy the patched kernel on all affected systems; consider disabling ksmbd if SMB sharing is not required.

How to confirm the fix worked

Verify the running kernel includes commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed via git log or uname; test SMB2 session setup with boundary UserName values in a lab environment to confirm absence of the read.

Typical attack path

1. Connect to a target exposing ksmbd over SMB
2. Send a crafted SMB2 session setup or negotiation packet with manipulated UserName
3. Trigger out-of-bounds read in smb2pdu.c processing
4. Read adjacent kernel memory or induce kernel panic

How to detect it

Inspect kernel logs for ksmbd-related oops or out-of-bounds warnings; correlate unusual SMB2 session setup packets with source addresses; review audit logs for unexpected ksmbd process behavior.

• ksmbd.*out-of-bounds
• smb2pdu.c
• UserName.*security buffer

What your security team should do

• Apply the fixed kernel commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed immediately on all production systems
• Disable ksmbd module if SMB file sharing is not essential
• Monitor for kernel oops or crashes related to ksmbd
• Review network exposure of SMB ports and apply network segmentation