CVE-2023-6606

What it actually does

Out-of-bounds read in smbCalcSize allows a local process to read past the end of a kernel buffer allocated for SMB client operations, resulting in either a kernel panic or disclosure of adjacent kernel memory contents.

Why it matters to the business

Linux systems using the SMB client may experience unexpected crashes that interrupt workloads or expose internal kernel data that could aid further attacks; urgency is low given the absence from KEV and stable low EPSS.

How an attack unfolds

An attacker with local code execution on a vulnerable Linux kernel crafts a malicious SMB response or file that causes smbCalcSize to compute an incorrect size, triggering the out-of-bounds read during subsequent memory access.

How to fix it

Upgrade the Linux kernel to a version containing commit 0dd3ee31125508cd67f7e7172247f05b7fd1753a or later; apply the patch from the gregkh/linux repository and rebuild or install the updated package for all affected distributions.

How to confirm the fix worked

Verify the running kernel contains commit 0dd3ee31125508cd67f7e7172247f05b7fd1753a by inspecting /proc/version or the kernel build log; recompile test cases that previously triggered the OOB read to confirm the condition no longer occurs.

Typical attack path

1. Gain local user or process execution on the target Linux system
2. Trigger SMB client operations against a controlled or malicious server
3. Supply a malformed SMB packet that reaches smbCalcSize with an oversized or negative length value
4. Observe kernel panic or harvest leaked kernel memory for further exploitation

How to detect it

Review kernel logs for oops or panic messages referencing smbCalcSize or netmisc.c; correlate with processes performing SMB mounts or file operations immediately prior to the event.

What your security team should do

• Prioritize kernel updates on systems that mount SMB shares from untrusted servers
• Monitor upstream stable kernel releases for backports of the referenced commit
• Restrict unprivileged local access where possible until patches are deployed
• Review SMB client usage in container and virtualized workloads for additional exposure