CVE-2023-54203

Critical · 9.1

CVSS

9.1

EPSS

0.5%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing code can cause the system to crash when it receives certain old-style network requests meant for very old servers.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Data Exposure
Component: OS kernel
Class: Buffer Overflow
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Out-of-bounds memory read in ksmbd's init_smb2_rsp_hdr when an SMB1 negotiate request is incorrectly routed to SMB2 server operation handlers, triggered by missing SMB1 command dispatch paths.

Why it matters to the business

Potential denial-of-service crashes on Linux systems exposing ksmbd file shares; low likelihood of remote code execution but can disrupt network file access services until patched.

How an attack unfolds

An attacker connects to a ksmbd-enabled SMB port and issues a 56-byte SMB1 negotiate request. Because SMB1 operations are not registered, the request falls through to SMB2 handlers that read beyond allocated response buffer bounds during header initialization.

How to fix it

Apply the upstream kernel fix in commit 921536046bd165efeb07beef5630aff35cd6a489 or later stable releases containing it; rebuild and reboot affected systems; disable ksmbd if SMB sharing is not required.

How to confirm the fix worked

Verify the running kernel contains commit 921536046bd165efeb07beef5630aff35cd6a489 via git log or kernel version string; attempt an SMB1 negotiate from a client using vers=1.0 and confirm absence of KASAN slab-out-of-bounds reports.

Typical attack path

Establish TCP connection to TCP/445
Send SMB1 negotiate protocol request (56 bytes)
Trigger ksmbd workqueue handling that calls init_smb2_rsp_hdr
Observe slab-out-of-bounds read and potential kernel oops or panic

How to detect it

Search kernel logs and dmesg for strings containing 'init_smb2_rsp_hdr', 'slab-out-of-bounds', 'KASAN', or 'ksmbd: init_smb2_rsp_hdr' around SMB connection attempts; correlate with CIFS client logs showing vers=1.0 attempts.

ksmbd: init_smb2_rsp_hdr : 492
BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr
Read of size 16 at addr .* by task kworker.*ksmbd
CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended

What your security team should do

Patch kernels to the fixed commit immediately on any system running ksmbd
Audit configurations for unnecessary SMB1 dialect support and disable it
Monitor kernel logs for KASAN or ksmbd slab-out-of-bounds entries
Consider replacing ksmbd with alternative SMB implementations if feasible

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it. [ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes [ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 [ 411.479323] ================================================================== [ 411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 [ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE 6.1.21 #3 [ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 411.479425] Call Trace: [ 411.479428] <TASK> [ 411.479432] dump_stack_lvl+0x49/0x63 [ 411.479444] print_report+0x171/0x4a8 [ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 [ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479497] kasan_report+0xb4/0x130 [ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479537] kasan_check_range+0x149/0x1e0 [ 411.479543] memcpy+0x24/0x70 [ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd] [ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50 [ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd] [ 411.479656] process_one_work+0x49c/0x790 [ 411.479667] worker_thread+0x2b1/0x6e0 [ 411.479674] ? process_one_work+0x790/0x790 [ 411.479680] kthread+0x177/0x1b0 [ 411.479686] ? kthread_complete_and_exit+0x30/0x30 [ 411.479692] ret_from_fork+0x22/0x30 [ 411.479702] </TASK>

Affected packages

Ecosystem	Package	Introduced	Fixed
Linux	Kernel	5.15.105	5.15.145