Cloudanix VulnDB

CVE-2023-54250

None

CVSS

—

EPSS

0.5%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's built-in SMB file-sharing code could let a remote user send a malformed network packet that crashes the server or reads memory it should not access.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds memory access during SMB2 negotiation context decoding in ksmbd when client-controlled DataLength allows the HashAlgorithms pointer in smb2_preauth_neg_context to reference memory beyond the received packet boundary.

Why it matters to the business

Kernel memory corruption or crash on Linux systems exposing SMB file shares can interrupt critical file services, require emergency reboots, and create brief windows of service unavailability; low exploitability keeps immediate ransomware or data-theft risk modest.

How an attack unfolds

An attacker establishes an SMB connection and sends a specially crafted negotiate request containing a preauth negotiation context whose DataLength value is crafted so that decode_preauth_ctxt dereferences a pointer outside the packet buffer, potentially reading or corrupting adjacent kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit 39f5b4b313b445c980a2a295bed28228c29228ed or later; rebuild and reboot affected systems; disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Verify the running kernel contains commit 39f5b4b313b445c980a2a295bed28228c29228ed or an equivalent backport; inspect /proc/version or uname output against the fixed release; confirm ksmbd module is either absent or from a patched build.

Typical attack path

  1. Establish unauthenticated SMB connection to target ksmbd instance
  2. Send SMB2 NEGOTIATE request embedding a preauth neg context with malicious DataLength
  3. Trigger decode_preauth_ctxt path that performs out-of-bounds pointer access
  4. Observe kernel oops, memory disclosure, or attempt further exploitation of resulting corruption

How to detect it

Review kernel logs for oops or panic entries referencing decode_preauth_ctxt or ksmbd; inspect network captures for SMB negotiate requests containing preauth contexts with unusually large or malformed DataLength values.

What your security team should do

  • Apply the referenced kernel commit or distribution update within the next maintenance window
  • Review SMB exposure and disable ksmbd on systems that do not need it
  • Monitor vendor advisories for distribution-specific backports
  • Add kernel oops and SMB negotiation anomaly alerts to existing monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: avoid out of bounds access in decode_preauth_ctxt() Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient. Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.15.145
Linux Kernel 5.15.0 5.15.145

Related vulnerabilities