Vulnerability-Lookup

GHSA-F39W-X49R-J8P2

Vulnerability from github – Published: 2025-12-30 15:30 – Updated: 2026-08-04 12:34

Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: avoid out of bounds access in decode_preauth_ctxt()

Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient.

Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-54250"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-30T13:16:13Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: avoid out of bounds access in decode_preauth_ctxt()\n\nConfirm that the accessed pneg_ctxt-\u003eHashAlgorithms address sits within\nthe SMB request boundary; deassemble_neg_contexts() only checks that the\neight byte smb2_neg_context header + (client controlled) DataLength are\nwithin the packet boundary, which is insufficient.\n\nChecking for sizeof(struct smb2_preauth_neg_context) is overkill given\nthat the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.",
  "id": "GHSA-f39w-x49r-j8p2",
  "modified": "2026-08-04T12:34:49Z",
  "published": "2025-12-30T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54250"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/39f5b4b313b445c980a2a295bed28228c29228ed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f02edb9debbd36f44efa7567031485892c7df60d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-54250 (GCVE-0-2023-54250)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:15 – Updated: 2026-08-05 09:18

Title

ksmbd: avoid out of bounds access in decode_preauth_ctxt()

Summary

In the Linux kernel, the following vulnerability has been resolved: ksmbd: avoid out of bounds access in decode_preauth_ctxt() Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient. Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/39f5b4b313b445c98…
https://git.kernel.org/stable/c/a2f6ded41bec1d3be…
https://git.kernel.org/stable/c/f02edb9debbd36f44…
https://git.kernel.org/stable/c/e7067a446264a7514…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 39f5b4b313b445c980a2a295bed28228c29228ed (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < a2f6ded41bec1d3be643c80a5eb97f1680309001 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < f02edb9debbd36f44efa7567031485892c7df60d (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < e7067a446264a7514fa1cfaa4052cdb6803bc6a2 (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.145 , ≤ 5.15.* (semver) Unaffected: 6.1.25 , ≤ 6.1.* (semver) Unaffected: 6.2.12 , ≤ 6.2.* (semver) Unaffected: 6.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39f5b4b313b445c980a2a295bed28228c29228ed",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "a2f6ded41bec1d3be643c80a5eb97f1680309001",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "f02edb9debbd36f44efa7567031485892c7df60d",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e7067a446264a7514fa1cfaa4052cdb6803bc6a2",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.25",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.12",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: avoid out of bounds access in decode_preauth_ctxt()\n\nConfirm that the accessed pneg_ctxt-\u003eHashAlgorithms address sits within\nthe SMB request boundary; deassemble_neg_contexts() only checks that the\neight byte smb2_neg_context header + (client controlled) DataLength are\nwithin the packet boundary, which is insufficient.\n\nChecking for sizeof(struct smb2_preauth_neg_context) is overkill given\nthat the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd, the in-kernel SMB server, and is triggered by parsing an SMB2 NEGOTIATE PDU received on TCP port 445. Any host able to reach the server\u0027s SMB port can send the malformed packet.\nAC:L - A single crafted NEGOTIATE request with a preauth-integrity context placed in the last 8 bytes of the PDU and DataLength=0 deterministically drives the read past the buffer; the attacker also chooses the exact kvmalloc size (pdu_size+4) and can repeat the connection freely to arrange a page-boundary-aligned or vmalloc-backed buffer.\nPR:N - SMB2 NEGOTIATE is the very first request on a connection, processed before session setup, authentication, or tree connect; ksmbd_smb2_check_message() even exempts NEGOTIATE from length validation. No credentials of any kind are required.\nUI:N - The server-side kthread parses the attacker\u0027s packet automatically on connection; no local user or administrator action is involved.\nS:U - The out-of-bounds read and its consequences are confined to the kernel\u0027s own memory and the ksmbd service; no security authority boundary such as a VM or IOMMU is crossed.\nC:L - The out-of-bounds access reads 2 bytes of adjacent heap memory at a fixed +4/+5 offset past the request buffer; the value is not returned, but the differing NEGOTIATE status code leaks whether those bytes equal 0x0001, giving a repeatable but strictly bounded heap-content oracle.\nI:N - decode_preauth_ctxt() only reads; no attacker- or OOB-derived data is written anywhere, and conn-\u003epreauth_info-\u003ePreauth_HashId is assigned a fixed constant on the success path, so no kernel state is corrupted.\nA:H - Because the attacker sizes the kvmalloc\u0027d request buffer exactly, the buffer can end on a page boundary and \u2014 via the vmalloc fallback taken when the __GFP_NORETRY high-order kmalloc fails under attacker-induced memory pressure \u2014 the read strikes a guard page, causing an unrecoverable kernel page fault and oops (full panic with panic_on_oops); it also faults under KASAN/KFENCE/DEBUG_PAGEALLOC builds."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:25.471Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39f5b4b313b445c980a2a295bed28228c29228ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001"
        },
        {
          "url": "https://git.kernel.org/stable/c/f02edb9debbd36f44efa7567031485892c7df60d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2"
        }
      ],
      "title": "ksmbd: avoid out of bounds access in decode_preauth_ctxt()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54250",
    "datePublished": "2025-12-30T12:15:47.467Z",
    "dateReserved": "2025-12-30T12:06:44.514Z",
    "dateUpdated": "2026-08-05T09:18:25.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.