CVE-2023-54203 (GCVE-0-2023-54203)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:09 – Updated: 2026-08-05 09:18
VLAI
Title
ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it. [ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes [ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 [ 411.479323] ================================================================== [ 411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 [ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE 6.1.21 #3 [ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 411.479425] Call Trace: [ 411.479428] <TASK> [ 411.479432] dump_stack_lvl+0x49/0x63 [ 411.479444] print_report+0x171/0x4a8 [ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 [ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479497] kasan_report+0xb4/0x130 [ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479537] kasan_check_range+0x149/0x1e0 [ 411.479543] memcpy+0x24/0x70 [ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd] [ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50 [ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd] [ 411.479656] process_one_work+0x49c/0x790 [ 411.479667] worker_thread+0x2b1/0x6e0 [ 411.479674] ? process_one_work+0x790/0x790 [ 411.479680] kthread+0x177/0x1b0 [ 411.479686] ? kthread_complete_and_exit+0x30/0x30 [ 411.479692] ret_from_fork+0x22/0x30 [ 411.479702] </TASK>
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 51a8534c0f35c0401e45f1055f914729cad98bf9 , < 921536046bd165efeb07beef5630aff35cd6a489 (git)
Affected: 0b3ec5671ac06829ccebdaeec05acedfec327f42 , < a8334a0c535d0f0b4d64926c8fe0922ed98f7d43 (git)
Affected: cc32cd98a0aee4cc3eb611cbce11795b1aaa738a , < 99a51c673b1d2d0b5a972353401b77612d9cc713 (git)
Affected: 39b291b86b5988bf8753c3874d5c773399d09b96 , < dc8289f912387c3bcfbc5d2db29c8947fa207c11 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15.105 , < 5.15.145 (semver)
Affected: 6.1.22 , < 6.1.24 (semver)
Affected: 6.2.9 , < 6.2.11 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/server.c",
            "fs/ksmbd/smb2pdu.c",
            "fs/ksmbd/smb_common.c",
            "fs/ksmbd/smb_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "921536046bd165efeb07beef5630aff35cd6a489",
              "status": "affected",
              "version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
              "versionType": "git"
            },
            {
              "lessThan": "a8334a0c535d0f0b4d64926c8fe0922ed98f7d43",
              "status": "affected",
              "version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
              "versionType": "git"
            },
            {
              "lessThan": "99a51c673b1d2d0b5a972353401b77612d9cc713",
              "status": "affected",
              "version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
              "versionType": "git"
            },
            {
              "lessThan": "dc8289f912387c3bcfbc5d2db29c8947fa207c11",
              "status": "affected",
              "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/server.c",
            "fs/ksmbd/smb2pdu.c",
            "fs/ksmbd/smb_common.c",
            "fs/ksmbd/smb_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.145",
              "status": "affected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.24",
              "status": "affected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.11",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.24",
                  "versionStartIncluding": "6.1.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.11",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr\n\nWhen smb1 mount fails, KASAN detect slab-out-of-bounds in\ninit_smb2_rsp_hdr like the following one.\nFor smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called.\nThe issue occurs while handling smb1 negotiate as smb2 server operations.\nAdd smb server operations for smb1 (get_cmd_val, init_rsp_hdr,\nallocate_rsp_buf, check_user_session) to handle smb1 negotiate so that\nsmb2 server operation does not handle it.\n\n[  411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is\nnot recommended unless required for access to very old servers\n[  411.400452] CIFS: Attempting to mount \\\\192.168.45.139\\homes\n[  411.479312] ksmbd: init_smb2_rsp_hdr : 492\n[  411.479323] ==================================================================\n[  411.479327] BUG: KASAN: slab-out-of-bounds in\ninit_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199\n\n[  411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G\n OE      6.1.21 #3\n[  411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8\nSeries/Z10PA-D8 Series, BIOS 3801 08/23/2019\n[  411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]\n[  411.479425] Call Trace:\n[  411.479428]  \u003cTASK\u003e\n[  411.479432]  dump_stack_lvl+0x49/0x63\n[  411.479444]  print_report+0x171/0x4a8\n[  411.479452]  ? kasan_complete_mode_report_info+0x3c/0x200\n[  411.479463]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479497]  kasan_report+0xb4/0x130\n[  411.479503]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479537]  kasan_check_range+0x149/0x1e0\n[  411.479543]  memcpy+0x24/0x70\n[  411.479550]  init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479585]  handle_ksmbd_work+0x109/0x760 [ksmbd]\n[  411.479616]  ? _raw_spin_unlock_irqrestore+0x50/0x50\n[  411.479624]  ? smb3_encrypt_resp+0x340/0x340 [ksmbd]\n[  411.479656]  process_one_work+0x49c/0x790\n[  411.479667]  worker_thread+0x2b1/0x6e0\n[  411.479674]  ? process_one_work+0x790/0x790\n[  411.479680]  kthread+0x177/0x1b0\n[  411.479686]  ? kthread_complete_and_exit+0x30/0x30\n[  411.479692]  ret_from_fork+0x22/0x30\n[  411.479702]  \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445; the vulnerable `init_smb2_rsp_hdr()` is reached directly from `ksmbd_conn_handler_loop()` processing bytes received from a remote peer. No local access is involved.\nAC:L - The attacker simply opens a TCP connection and sends one crafted SMB1-protocol PDU with a short RFC1002 length; the 16-byte read at fixed offset 52-68 occurs deterministically with no race and no dependence on conditions outside the attacker\u0027s control (the attacker even picks the allocation size, hence the slab bucket).\nPR:N - The defect triggers on the very first packet of a connection, in `init_rsp_hdr()` which runs before `ksmbd_verify_smb_message()`, before negotiate completes and before any session setup or credential validation. No authentication whatsoever is required.\nUI:N - The attacker drives the entire exchange by connecting to the SMB port and sending a packet; no action by any local user or administrator is needed.\nS:U - The out-of-bounds read and its consequences are confined to the kernel\u0027s own memory and the ksmbd server\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - 16 bytes of adjacent kernel slab memory are memcpy\u0027d into the response Signature field and transmitted back to the unauthenticated attacker via `ksmbd_conn_write()` (response length 64 includes offsets 52-68), and the attacker chooses `pdu_size` to select the slab cache and read distance \u2014 a repeatable, groomable disclosure of kernel heap contents including pointers and neighbouring session data.\nI:N - The defect is a read past the end of the request buffer; all writes (the response header memset/memcpy) stay within the 448-byte response allocation, so no out-of-bounds write or kernel data modification primitive exists.\nA:H - The read runs off the end of a tiny attacker-sized kmalloc object and is reported by KASAN as shown in the commit (a panic on `panic_on_warn` kernels), and on KFENCE/DEBUG_PAGEALLOC-enabled distro kernels it can fault on a guard page, oopsing the ksmbd workqueue thread; the attacker can retry indefinitely pre-authentication to hit that condition."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:01.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/921536046bd165efeb07beef5630aff35cd6a489"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8334a0c535d0f0b4d64926c8fe0922ed98f7d43"
        },
        {
          "url": "https://git.kernel.org/stable/c/99a51c673b1d2d0b5a972353401b77612d9cc713"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc8289f912387c3bcfbc5d2db29c8947fa207c11"
        }
      ],
      "title": "ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54203",
    "datePublished": "2025-12-30T12:09:07.538Z",
    "dateReserved": "2025-12-30T12:06:44.499Z",
    "dateUpdated": "2026-08-05T09:18:01.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54203",
      "date": "2026-09-27",
      "epss": "0.00543",
      "percentile": "0.43375"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ksmbd/server.c",
                  "fs/ksmbd/smb2pdu.c",
                  "fs/ksmbd/smb_common.c",
                  "fs/ksmbd/smb_common.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "921536046bd165efeb07beef5630aff35cd6a489",
                    "status": "affected",
                    "version": "51a8534c0f35c0401e45f1055f914729cad98bf9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a8334a0c535d0f0b4d64926c8fe0922ed98f7d43",
                    "status": "affected",
                    "version": "0b3ec5671ac06829ccebdaeec05acedfec327f42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "99a51c673b1d2d0b5a972353401b77612d9cc713",
                    "status": "affected",
                    "version": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc8289f912387c3bcfbc5d2db29c8947fa207c11",
                    "status": "affected",
                    "version": "39b291b86b5988bf8753c3874d5c773399d09b96",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ksmbd/server.c",
                  "fs/ksmbd/smb2pdu.c",
                  "fs/ksmbd/smb_common.c",
                  "fs/ksmbd/smb_common.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5.15.145",
                    "status": "affected",
                    "version": "5.15.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.24",
                    "status": "affected",
                    "version": "6.1.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.11",
                    "status": "affected",
                    "version": "6.2.9",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr\n\nWhen smb1 mount fails, KASAN detect slab-out-of-bounds in\ninit_smb2_rsp_hdr like the following one.\nFor smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called.\nThe issue occurs while handling smb1 negotiate as smb2 server operations.\nAdd smb server operations for smb1 (get_cmd_val, init_rsp_hdr,\nallocate_rsp_buf, check_user_session) to handle smb1 negotiate so that\nsmb2 server operation does not handle it.\n\n[  411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is\nnot recommended unless required for access to very old servers\n[  411.400452] CIFS: Attempting to mount \\\\192.168.45.139\\homes\n[  411.479312] ksmbd: init_smb2_rsp_hdr : 492\n[  411.479323] ==================================================================\n[  411.479327] BUG: KASAN: slab-out-of-bounds in\ninit_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199\n\n[  411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G\n OE      6.1.21 #3\n[  411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8\nSeries/Z10PA-D8 Series, BIOS 3801 08/23/2019\n[  411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]\n[  411.479425] Call Trace:\n[  411.479428]  \u003cTASK\u003e\n[  411.479432]  dump_stack_lvl+0x49/0x63\n[  411.479444]  print_report+0x171/0x4a8\n[  411.479452]  ? kasan_complete_mode_report_info+0x3c/0x200\n[  411.479463]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479497]  kasan_report+0xb4/0x130\n[  411.479503]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479537]  kasan_check_range+0x149/0x1e0\n[  411.479543]  memcpy+0x24/0x70\n[  411.479550]  init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]\n[  411.479585]  handle_ksmbd_work+0x109/0x760 [ksmbd]\n[  411.479616]  ? _raw_spin_unlock_irqrestore+0x50/0x50\n[  411.479624]  ? smb3_encrypt_resp+0x340/0x340 [ksmbd]\n[  411.479656]  process_one_work+0x49c/0x790\n[  411.479667]  worker_thread+0x2b1/0x6e0\n[  411.479674]  ? process_one_work+0x790/0x790\n[  411.479680]  kthread+0x177/0x1b0\n[  411.479686]  ? kthread_complete_and_exit+0x30/0x30\n[  411.479692]  ret_from_fork+0x22/0x30\n[  411.479702]  \u003c/TASK\u003e"
          }
        ],
        "id": "CVE-2023-54203",
        "lastModified": "2026-08-04T11:16:36.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:08.420",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/921536046bd165efeb07beef5630aff35cd6a489"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/99a51c673b1d2d0b5a972353401b77612d9cc713"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a8334a0c535d0f0b4d64926c8fe0922ed98f7d43"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc8289f912387c3bcfbc5d2db29c8947fa207c11"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T15:53:07+00:00",
      "cve": "CVE-2023-54203",
      "id": "CVE-2023-54203",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel ksmbd: Slab-out-of-bounds vulnerability allows information disclosure and denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54203.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:03:21Z",
      "cve": "CVE-2023-54203",
      "id": "CVE-2023-54203",
      "initial_release_date": "2025-12-31T00:28:34Z",
      "product_status:known_not_affected": "560",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54203",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54203.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.