CVE-2023-38429

What it actually does

Off-by-one error in ksmbd_smb2_check_message memory allocation in fs/ksmbd/connection.c allows out-of-bounds access during SMB2 message processing.

Why it matters to the business

Remote attackers could gain full control of affected Linux servers, leading to data theft, ransomware deployment, or service disruption; widespread use of Linux kernel increases exposure across servers and embedded devices.

How an attack unfolds

An attacker with network access to the ksmbd SMB service sends a crafted SMB2 message that exploits the off-by-one allocation error, resulting in out-of-bounds memory access that may be leveraged for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to version 6.3.4 or later; apply commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed to fs/ksmbd/connection.c; disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Verify kernel version is 6.3.4 or newer; confirm the patch commit is present in the source tree; test SMB2 message handling with boundary-value inputs to ensure no OOB access occurs.

Typical attack path

1. Identify Linux hosts exposing ksmbd on TCP ports 445 or 139
2. Craft and send malicious SMB2 negotiation or session setup packets
3. Trigger off-by-one allocation via ksmbd_smb2_check_message
4. Perform out-of-bounds read/write to corrupt kernel memory
5. Escalate to remote code execution or kernel panic

How to detect it

Review kernel logs for oops/panic messages referencing ksmbd or connection.c; inspect network traffic for SMB2 packets with unusual lengths around message boundaries; correlate with failed authentication attempts or sudden process crashes in smbd/ksmbd.

• kernel: ksmbd: out-of-bounds
• fs/ksmbd/connection.c
• ksmbd_smb2_check_message
• SMB2 malformed packet length near allocation boundary

What your security team should do

• Prioritize kernel upgrades on all internet-facing or internal SMB servers within 30 days given high CVSS and public exploitability
• Monitor EPSS score trajectory and add CVE to vulnerability scanning policies
• Disable ksmbd module where SMB shares are not needed and enforce network segmentation for SMB traffic
• Update detection rules to alert on anomalous SMB2 packet sizes or connection.c related crashes