CVE-2023-52440

What it actually does

A bounds check failure in ksmbd_decode_ntlmssp_auth_blob allows an oversized SessionKey.Length value to trigger a slub overflow when cifs_arc4_crypt copies data into a fixed-size CIFS_KEY_SIZE session-key buffer.

Why it matters to the business

Systems running the ksmbd SMB server in the Linux kernel face risk of local memory corruption that can lead to crashes, denial of service, or elevation of privilege; the flaw has been public for over two years with stable kernel fixes available.

How an attack unfolds

An authenticated local user crafts an NTLMSSP authentication blob containing a SessionKey.Length larger than CIFS_KEY_SIZE, sends it during SMB session setup, and triggers the overflow inside the kernel's key-exchange path.

How to fix it

Apply the upstream fix present in commit bd554ed4fdc3d38404a1c43d428432577573e809 or later; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit bd554ed4fdc3d38404a1c43d428432577573e809 or a back-port that adds the length check before the cifs_arc4_crypt call; confirm with kernel build logs or git log output.

Typical attack path

1. Establish a local or SMB connection to a ksmbd-enabled system
2. Begin NTLM authentication and supply an auth blob with SessionKey.Length exceeding CIFS_KEY_SIZE
3. Trigger ksmbd_decode_ntlmssp_auth_blob and subsequent cifs_arc4_crypt copy
4. Achieve memory corruption leading to crash or code execution

How to detect it

Review kernel logs for slub-related warnings or oops messages referencing ksmbd_decode_ntlmssp_auth_blob or cifs_arc4_crypt; inspect audit logs for unusual SMB session-setup activity from local users.

What your security team should do

• Patch all kernels containing ksmbd to the fixed commit immediately
• Disable ksmbd if SMB server functionality is not required
• Monitor for local privilege-escalation attempts against SMB services
• Restrict local user access to systems exposing ksmbd until patched