CVE-2023-52441

What it actually does

Out-of-bounds memory access in ksmbd's init_smb2_rsp_hdr when an SMB2 negotiate request is followed by an SMB1 negotiate request after need_neg is cleared, allowing malformed packet handling to corrupt adjacent kernel memory.

Why it matters to the business

Local attackers on systems running vulnerable kernels with ksmbd enabled can achieve full system compromise, leading to data theft, ransomware deployment, or persistent access; high prevalence in Linux environments increases exposure for servers and appliances.

How an attack unfolds

An attacker with local access sends a valid SMB2 negotiate request to set need_neg false, then immediately follows with an SMB1 negotiate request; this causes init_smb2_rsp_hdr to process the SMB1 packet and perform an out-of-bounds write, enabling memory corruption for privilege escalation or code execution.

How to fix it

Apply the upstream fix by updating the Linux kernel to a version containing commit 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b; rebuild and deploy the patched kernel across all affected systems; disable ksmbd if SMB services are not required.

How to confirm the fix worked

Verify the running kernel includes commit 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b or later equivalent; test SMB negotiate sequences with mixed SMB1/SMB2 packets to confirm no crash or corruption occurs; monitor kernel logs for related oops or warnings.

Typical attack path

1. Obtain local access or execute code on target Linux system with ksmbd enabled
2. Send SMB2 negotiate request to set need_neg to false
3. Send crafted SMB1 negotiate request to trigger init_smb2_rsp_hdr
4. Exploit resulting out-of-bounds memory corruption for arbitrary code execution
5. Escalate privileges or install persistent malware

How to detect it

Review kernel logs and audit records for unexpected SMB negotiate handling errors or oops following mixed SMB1/SMB2 traffic; inspect ksmbd process activity and memory dumps for signs of corruption after negotiate requests.

What your security team should do

• Immediately upgrade all Linux kernels to the fixed version containing commit 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b
• Disable ksmbd module if SMB file sharing is unnecessary
• Implement network segmentation to limit SMB exposure from untrusted local processes
• Add kernel memory protection mechanisms such as KASAN or hardened allocators in build pipelines