CVE-2023-38432

What it actually does

The vulnerability allows an out-of-bounds read in the ksmbd SMB server implementation due to insufficient validation between the command payload size and the RFC1002 length specification in fs/smb/server/smb2misc.c.

Why it matters to the business

Organizations running Linux systems with ksmbd enabled may face risks of data exposure or service disruption from remote attackers, though the issue has been public for over three years with no known exploitation.

How an attack unfolds

An attacker crafts a malicious SMB2 packet with a mismatched payload size and RFC1002 length, sending it to a vulnerable ksmbd server, which then performs an out-of-bounds read potentially leaking memory contents or causing a crash.

How to fix it

Upgrade the Linux kernel to version 6.3.10 or later, or apply the fix from commit cdd3cdb682f4939aa1adeff025b97e75a9a0f5b3 in the ksmbd module.

How to confirm the fix worked

Verify the kernel version is at least 6.3.10 and test SMB connections to ensure no crashes or unexpected behavior on malformed packets.

Typical attack path

1. Identify a target Linux system with ksmbd enabled
2. Craft a malformed SMB2 packet exploiting the size validation flaw
3. Send the packet over the network to trigger the out-of-bounds read
4. Observe response for potential data leakage or denial of service

How to detect it

Examine network logs for unusual SMB traffic patterns or kernel logs for oops or panic messages related to smb2misc.c around the time of suspected attacks.

What your security team should do

• Prioritize patching Linux kernels with ksmbd to the fixed version
• Disable ksmbd if not required
• Monitor for any new exploitation reports given the time since disclosure