CVE-2023-54250 (GCVE-0-2023-54250)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:15 – Updated: 2026-08-05 09:18
VLAI
Title
ksmbd: avoid out of bounds access in decode_preauth_ctxt()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: avoid out of bounds access in decode_preauth_ctxt() Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient. Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 39f5b4b313b445c980a2a295bed28228c29228ed (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < a2f6ded41bec1d3be643c80a5eb97f1680309001 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < f02edb9debbd36f44efa7567031485892c7df60d (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < e7067a446264a7514fa1cfaa4052cdb6803bc6a2 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.145 , ≤ 5.15.* (semver)
Unaffected: 6.1.25 , ≤ 6.1.* (semver)
Unaffected: 6.2.12 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39f5b4b313b445c980a2a295bed28228c29228ed",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "a2f6ded41bec1d3be643c80a5eb97f1680309001",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "f02edb9debbd36f44efa7567031485892c7df60d",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e7067a446264a7514fa1cfaa4052cdb6803bc6a2",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.25",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.12",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: avoid out of bounds access in decode_preauth_ctxt()\n\nConfirm that the accessed pneg_ctxt-\u003eHashAlgorithms address sits within\nthe SMB request boundary; deassemble_neg_contexts() only checks that the\neight byte smb2_neg_context header + (client controlled) DataLength are\nwithin the packet boundary, which is insufficient.\n\nChecking for sizeof(struct smb2_preauth_neg_context) is overkill given\nthat the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd, the in-kernel SMB server, and is triggered by parsing an SMB2 NEGOTIATE PDU received on TCP port 445. Any host able to reach the server\u0027s SMB port can send the malformed packet.\nAC:L - A single crafted NEGOTIATE request with a preauth-integrity context placed in the last 8 bytes of the PDU and DataLength=0 deterministically drives the read past the buffer; the attacker also chooses the exact kvmalloc size (pdu_size+4) and can repeat the connection freely to arrange a page-boundary-aligned or vmalloc-backed buffer.\nPR:N - SMB2 NEGOTIATE is the very first request on a connection, processed before session setup, authentication, or tree connect; ksmbd_smb2_check_message() even exempts NEGOTIATE from length validation. No credentials of any kind are required.\nUI:N - The server-side kthread parses the attacker\u0027s packet automatically on connection; no local user or administrator action is involved.\nS:U - The out-of-bounds read and its consequences are confined to the kernel\u0027s own memory and the ksmbd service; no security authority boundary such as a VM or IOMMU is crossed.\nC:L - The out-of-bounds access reads 2 bytes of adjacent heap memory at a fixed +4/+5 offset past the request buffer; the value is not returned, but the differing NEGOTIATE status code leaks whether those bytes equal 0x0001, giving a repeatable but strictly bounded heap-content oracle.\nI:N - decode_preauth_ctxt() only reads; no attacker- or OOB-derived data is written anywhere, and conn-\u003epreauth_info-\u003ePreauth_HashId is assigned a fixed constant on the success path, so no kernel state is corrupted.\nA:H - Because the attacker sizes the kvmalloc\u0027d request buffer exactly, the buffer can end on a page boundary and \u2014 via the vmalloc fallback taken when the __GFP_NORETRY high-order kmalloc fails under attacker-induced memory pressure \u2014 the read strikes a guard page, causing an unrecoverable kernel page fault and oops (full panic with panic_on_oops); it also faults under KASAN/KFENCE/DEBUG_PAGEALLOC builds."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:25.471Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39f5b4b313b445c980a2a295bed28228c29228ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001"
        },
        {
          "url": "https://git.kernel.org/stable/c/f02edb9debbd36f44efa7567031485892c7df60d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2"
        }
      ],
      "title": "ksmbd: avoid out of bounds access in decode_preauth_ctxt()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54250",
    "datePublished": "2025-12-30T12:15:47.467Z",
    "dateReserved": "2025-12-30T12:06:44.514Z",
    "dateUpdated": "2026-08-05T09:18:25.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54250",
      "date": "2026-08-10",
      "epss": "0.00419",
      "percentile": "0.3458"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54250\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:13.660\",\"lastModified\":\"2026-08-04T11:16:38.250\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: avoid out of bounds access in decode_preauth_ctxt()\\n\\nConfirm that the accessed pneg_ctxt-\u003eHashAlgorithms address sits within\\nthe SMB request boundary; deassemble_neg_contexts() only checks that the\\neight byte smb2_neg_context header + (client controlled) DataLength are\\nwithin the packet boundary, which is insufficient.\\n\\nChecking for sizeof(struct smb2_preauth_neg_context) is overkill given\\nthat the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nksmbd: evitar el acceso fuera de l\u00edmites en decode_preauth_ctxt()\\n\\nConfirmar que la direcci\u00f3n pneg_ctxt-\u0026gt;HashAlgorithms accedida se encuentra dentro del l\u00edmite de la solicitud SMB; deassemble_neg_contexts() solo verifica que el encabezado smb2_neg_context de ocho bytes + (DataLength controlada por el cliente) est\u00e9n dentro del l\u00edmite del paquete, lo cual es insuficiente.\\n\\nVerificar sizeof(struct smb2_preauth_neg_context) es excesivo dado que el tipo actualmente asume SMB311_SALT_SIZE bytes de Salt final.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ksmbd/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"39f5b4b313b445c980a2a295bed28228c29228ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"a2f6ded41bec1d3be643c80a5eb97f1680309001\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"f02edb9debbd36f44efa7567031485892c7df60d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"e7067a446264a7514fa1cfaa4052cdb6803bc6a2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ksmbd/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.145\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.25\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.12\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/39f5b4b313b445c980a2a295bed28228c29228ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f02edb9debbd36f44efa7567031485892c7df60d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:17:56+00:00",
      "cve": "CVE-2023-54250",
      "id": "CVE-2023-54250",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: avoid out of bounds access in decode_preauth_ctxt()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54250.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:02:31Z",
      "cve": "CVE-2023-54250",
      "id": "CVE-2023-54250",
      "initial_release_date": "2025-12-31T00:27:30Z",
      "product_status:known_not_affected": "437",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54250",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54250.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.