CVE-2023-52755

What it actually does

Slab out-of-bounds write in smb_inherit_dacl() triggered when three offsets exceed the allocated pntsd buffer size, allowing kernel memory corruption.

Why it matters to the business

Local attackers can crash Linux systems or potentially escalate privileges on servers exposing the ksmbd SMB service, leading to downtime and data exposure risk across affected kernel deployments.

How an attack unfolds

An attacker with local access sends crafted SMB requests that cause smb_inherit_dacl() to compute offsets larger than the allocated security descriptor buffer, resulting in a write beyond the slab object boundary.

How to fix it

Upgrade the Linux kernel to a version containing commit aaf0a07d60887d6c36fc46a24de0083744f07819 or later stable releases that include the offset validation check in smb_inherit_dacl().

How to confirm the fix worked

Verify the running kernel contains the fix by checking git commit history or kernel version strings; attempt to reproduce the original offset calculation and confirm the new bounds check is present in the function.

Typical attack path

1. Obtain local shell or user context on target Linux host
2. Interact with ksmbd via local SMB connection or mount
3. Submit malicious DACL inheritance request with oversized offsets
4. Trigger slab write beyond allocation boundary
5. Achieve memory corruption for crash or code execution

How to detect it

Review kernel logs for slab out-of-bounds write warnings referencing smb_inherit_dacl or ksmbd; inspect audit logs for unusual local SMB activity around the time of any kernel oops or panic.

What your security team should do

• Prioritize kernel updates on all systems running ksmbd
• Disable ksmbd if SMB service is not required
• Monitor for local privilege escalation attempts post-update
• Apply patches within standard maintenance windows given high CVSS