GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52441 (GCVE-0-2023-52441)

Vulnerability from cvelistv5 – Published: 2024-02-21 07:21 – Updated: 2026-08-15 12:23
VLAI
Title
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:02 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 51a8534c0f35c0401e45f1055f914729cad98bf9 , < 5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b (git)
Affected: 0b3ec5671ac06829ccebdaeec05acedfec327f42 , < 330d900620dfc9893011d725b3620cd2ee0bc2bc (git)
Affected: 39b291b86b5988bf8753c3874d5c773399d09b96 , < aa669ef229ae8dd779da9caa24e254964545895f (git)
Affected: 39b291b86b5988bf8753c3874d5c773399d09b96 , < 536bb492d39bb6c080c92f31e8a55fe9934f452b (git)
Affected: cc32cd98a0aee4cc3eb611cbce11795b1aaa738a (git)
Affected: 5.15.105 , < 5.15.145 (semver)
Affected: 6.1.22 , < 6.1.53 (semver)
Affected: 6.2.9 , < 6.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 5.15.145 , ≤ 5.15.* (semver)
Unaffected: 6.1.53 , ≤ 6.1.* (semver)
Unaffected: 6.4.16 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.809Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52441",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:02:49.418159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:54.916Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/server.c",
            "fs/smb/server/smb_common.c",
            "fs/smb/server/smb_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b",
              "status": "affected",
              "version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
              "versionType": "git"
            },
            {
              "lessThan": "330d900620dfc9893011d725b3620cd2ee0bc2bc",
              "status": "affected",
              "version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
              "versionType": "git"
            },
            {
              "lessThan": "aa669ef229ae8dd779da9caa24e254964545895f",
              "status": "affected",
              "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
              "versionType": "git"
            },
            {
              "lessThan": "536bb492d39bb6c080c92f31e8a55fe9934f452b",
              "status": "affected",
              "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.145",
              "status": "affected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.53",
              "status": "affected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/server.c",
            "fs/smb/server/smb_common.c",
            "fs/smb/server/smb_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "6.1.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\n\nIf client send smb2 negotiate request and then send smb1 negotiate\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\nneed_neg is set to false. This patch ignore smb1 packets after -\u003eneed_neg\nis set to false."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd (fs/smb/server/), the in-kernel SMB server on TCP/445; init_smb2_rsp_hdr() runs while processing PDUs received from a remote peer via ksmbd_conn_handler_loop(), with no local access required.\nAC:L - The attacker reliably triggers the defect by sending an SMB2 negotiate (clearing need_neg) then an SMB1 negotiate on the same connection; both sides of the sequence and the small pdu_size that sizes the request slab object are fully attacker-controlled, with no race or external precondition.\nPR:N - The OOB occurs in init_rsp_hdr() during/after negotiate, before SESSION_SETUP and any credential check; smb2_check_user_session() does not require a session for negotiate, matching ZDI\u2019s unauthenticated assessment (ZDI-CAN-21541).\nUI:N - Exploitation needs only attacker-sent SMB negotiate PDUs to an already-running ksmbd listener; no local user or administrator action is required.\nS:U - The out-of-bounds read and leaked response data stay within the host kernel/ksmbd security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary cross.\nC:H - init_smb2_rsp_hdr() memcpy\u2019s 16 bytes of Signature (and copies SessionId/TreeId) from past the end of the attacker-sized SMB1 request buffer into the response, which ksmbd_conn_write() returns to the unauthenticated peer\u2014a groomable remote kernel-heap disclosure.\nI:N - The defect is a read past the request buffer; response writes stay inside the correctly allocated response buffer, so there is no out-of-bounds write or integrity/control-flow primitive from this bug alone.\nA:H - The overread past a tiny kmalloc request object can fault under KFENCE/DEBUG_PAGEALLOC or panic under KASAN/panic_on_warn (as in related KASAN reports), and the attacker can retrigger it pre-authentication at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-15T12:23:47.601Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
        },
        {
          "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
        },
        {
          "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
        }
      ],
      "title": "ksmbd: fix out of bounds in init_smb2_rsp_hdr()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52441",
    "datePublished": "2024-02-21T07:21:01.075Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-08-15T12:23:47.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52441",
      "date": "2026-09-19",
      "epss": "0.00679",
      "percentile": "0.50897"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9FF1671D-E1DC-4CBC-8438-A46DF4F1E978",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "10E7E9D1-2299-4B6E-945D-98FF23478015",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "5.16.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "447B7633-4054-4954-8C80-6F6098C5574B",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "6.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\n\nIf client send smb2 negotiate request and then send smb1 negotiate\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\nneed_neg is set to false. This patch ignore smb1 packets after -\u003eneed_neg\nis set to false."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ksmbd: correcci\u00f3n fuera de los l\u00edmites en init_smb2_rsp_hdr() Si el cliente env\u00eda una solicitud de negociaci\u00f3n smb2 y luego env\u00eda una solicitud de negociaci\u00f3n smb1, se llama a init_smb2_rsp_hdr para la solicitud de negociaci\u00f3n smb1 ya que need_neg est\u00e1 configurado en falso. Este parche ignora los paquetes smb1 despu\u00e9s de que -\u0026gt;need_neg se establece en falso."
        }
      ],
      "id": "CVE-2023-52441",
      "lastModified": "2024-11-21T08:39:46.177",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-21T08:15:45.463",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-119"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/server.c",
                  "fs/smb/server/smb_common.c",
                  "fs/smb/server/smb_common.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b",
                    "status": "affected",
                    "version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "330d900620dfc9893011d725b3620cd2ee0bc2bc",
                    "status": "affected",
                    "version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aa669ef229ae8dd779da9caa24e254964545895f",
                    "status": "affected",
                    "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "536bb492d39bb6c080c92f31e8a55fe9934f452b",
                    "status": "affected",
                    "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.145",
                    "status": "affected",
                    "version": "5.15.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.53",
                    "status": "affected",
                    "version": "6.1.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "affected",
                    "version": "6.2.9",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/server.c",
                  "fs/smb/server/smb_common.c",
                  "fs/smb/server/smb_common.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.4.*",
                    "status": "unaffected",
                    "version": "6.4.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.5",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9FF1671D-E1DC-4CBC-8438-A46DF4F1E978",
                    "versionEndExcluding": "5.15.145",
                    "versionStartIncluding": "5.15.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10E7E9D1-2299-4B6E-945D-98FF23478015",
                    "versionEndExcluding": "6.1.53",
                    "versionStartIncluding": "5.16.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "447B7633-4054-4954-8C80-6F6098C5574B",
                    "versionEndExcluding": "6.4.16",
                    "versionStartIncluding": "6.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\n\nIf client send smb2 negotiate request and then send smb1 negotiate\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\nneed_neg is set to false. This patch ignore smb1 packets after -\u003eneed_neg\nis set to false."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ksmbd: correcci\u00f3n fuera de los l\u00edmites en init_smb2_rsp_hdr() Si el cliente env\u00eda una solicitud de negociaci\u00f3n smb2 y luego env\u00eda una solicitud de negociaci\u00f3n smb1, se llama a init_smb2_rsp_hdr para la solicitud de negociaci\u00f3n smb1 ya que need_neg est\u00e1 configurado en falso. Este parche ignora los paquetes smb1 despu\u00e9s de que -\u0026gt;need_neg se establece en falso."
          }
        ],
        "id": "CVE-2023-52441",
        "lastModified": "2026-08-15T13:17:41.593",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52441",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:02:49.418159Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-21T08:15:45.463",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T00:46:33+00:00",
      "cve": "CVE-2023-52441",
      "id": "CVE-2023-52441",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ksmbd: fix out of bounds in init_smb2_rsp_hdr()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52441.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-09-03T16:51:01Z",
      "cve": "CVE-2023-52441",
      "id": "CVE-2023-52441",
      "initial_release_date": "2024-02-23T03:21:51Z",
      "product_status:known_not_affected": "365",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52441",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52441.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T22:55:41.809Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52441",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:02:49.418159Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:19.575Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/server/server.c",
                "fs/smb/server/smb_common.c",
                "fs/smb/server/smb_common.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b",
                  "status": "affected",
                  "version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
                  "versionType": "git"
                },
                {
                  "lessThan": "330d900620dfc9893011d725b3620cd2ee0bc2bc",
                  "status": "affected",
                  "version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
                  "versionType": "git"
                },
                {
                  "lessThan": "aa669ef229ae8dd779da9caa24e254964545895f",
                  "status": "affected",
                  "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
                  "versionType": "git"
                },
                {
                  "lessThan": "536bb492d39bb6c080c92f31e8a55fe9934f452b",
                  "status": "affected",
                  "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.15.145",
                  "status": "affected",
                  "version": "5.15.105",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.1.53",
                  "status": "affected",
                  "version": "6.1.22",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.3",
                  "status": "affected",
                  "version": "6.2.9",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/server/server.c",
                "fs/smb/server/smb_common.c",
                "fs/smb/server/smb_common.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.3"
                },
                {
                  "lessThan": "6.3",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.145",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.53",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.4.*",
                  "status": "unaffected",
                  "version": "6.4.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.5",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.145",
                      "versionStartIncluding": "5.15.105",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.53",
                      "versionStartIncluding": "6.1.22",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.4.16",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.5",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.2.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\n\nIf client send smb2 negotiate request and then send smb1 negotiate\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\nneed_neg is set to false. This patch ignore smb1 packets after -\u003eneed_neg\nis set to false."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The bug is in ksmbd (fs/smb/server/), the in-kernel SMB server on TCP/445; init_smb2_rsp_hdr() runs while processing PDUs received from a remote peer via ksmbd_conn_handler_loop(), with no local access required.\nAC:L - The attacker reliably triggers the defect by sending an SMB2 negotiate (clearing need_neg) then an SMB1 negotiate on the same connection; both sides of the sequence and the small pdu_size that sizes the request slab object are fully attacker-controlled, with no race or external precondition.\nPR:N - The OOB occurs in init_rsp_hdr() during/after negotiate, before SESSION_SETUP and any credential check; smb2_check_user_session() does not require a session for negotiate, matching ZDI\u2019s unauthenticated assessment (ZDI-CAN-21541).\nUI:N - Exploitation needs only attacker-sent SMB negotiate PDUs to an already-running ksmbd listener; no local user or administrator action is required.\nS:U - The out-of-bounds read and leaked response data stay within the host kernel/ksmbd security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary cross.\nC:H - init_smb2_rsp_hdr() memcpy\u2019s 16 bytes of Signature (and copies SessionId/TreeId) from past the end of the attacker-sized SMB1 request buffer into the response, which ksmbd_conn_write() returns to the unauthenticated peer\u2014a groomable remote kernel-heap disclosure.\nI:N - The defect is a read past the request buffer; response writes stay inside the correctly allocated response buffer, so there is no out-of-bounds write or integrity/control-flow primitive from this bug alone.\nA:H - The overread past a tiny kmalloc request object can fault under KFENCE/DEBUG_PAGEALLOC or panic under KASAN/panic_on_warn (as in related KASAN reports), and the attacker can retrigger it pre-authentication at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-15T12:23:47.601Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b"
            },
            {
              "url": "https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc"
            },
            {
              "url": "https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f"
            },
            {
              "url": "https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b"
            }
          ],
          "title": "ksmbd: fix out of bounds in init_smb2_rsp_hdr()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52441",
        "datePublished": "2024-02-21T07:21:01.075Z",
        "dateReserved": "2024-02-20T12:30:33.291Z",
        "dateUpdated": "2026-08-15T12:23:47.601Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.