{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54250", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.514Z", "datePublished": "2025-12-30T12:15:47.467Z", "dateUpdated": "2026-08-05T09:18:25.471Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:18:25.471Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: avoid out of bounds access in decode_preauth_ctxt()\n\nConfirm that the accessed pneg_ctxt->HashAlgorithms address sits within\nthe SMB request boundary; deassemble_neg_contexts() only checks that the\neight byte smb2_neg_context header + (client controlled) DataLength are\nwithin the packet boundary, which is insufficient.\n\nChecking for sizeof(struct smb2_preauth_neg_context) is overkill given\nthat the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is in ksmbd, the in-kernel SMB server, and is triggered by parsing an SMB2 NEGOTIATE PDU received on TCP port 445. Any host able to reach the server's SMB port can send the malformed packet.\nAC:L - A single crafted NEGOTIATE request with a preauth-integrity context placed in the last 8 bytes of the PDU and DataLength=0 deterministically drives the read past the buffer; the attacker also chooses the exact kvmalloc size (pdu_size+4) and can repeat the connection freely to arrange a page-boundary-aligned or vmalloc-backed buffer.\nPR:N - SMB2 NEGOTIATE is the very first request on a connection, processed before session setup, authentication, or tree connect; ksmbd_smb2_check_message() even exempts NEGOTIATE from length validation. No credentials of any kind are required.\nUI:N - The server-side kthread parses the attacker's packet automatically on connection; no local user or administrator action is involved.\nS:U - The out-of-bounds read and its consequences are confined to the kernel's own memory and the ksmbd service; no security authority boundary such as a VM or IOMMU is crossed.\nC:L - The out-of-bounds access reads 2 bytes of adjacent heap memory at a fixed +4/+5 offset past the request buffer; the value is not returned, but the differing NEGOTIATE status code leaks whether those bytes equal 0x0001, giving a repeatable but strictly bounded heap-content oracle.\nI:N - decode_preauth_ctxt() only reads; no attacker- or OOB-derived data is written anywhere, and conn->preauth_info->Preauth_HashId is assigned a fixed constant on the success path, so no kernel state is corrupted.\nA:H - Because the attacker sizes the kvmalloc'd request buffer exactly, the buffer can end on a page boundary and — via the vmalloc fallback taken when the __GFP_NORETRY high-order kmalloc fails under attacker-induced memory pressure — the read strikes a guard page, causing an unrecoverable kernel page fault and oops (full panic with panic_on_oops); it also faults under KASAN/KFENCE/DEBUG_PAGEALLOC builds." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ksmbd/smb2pdu.c" ], "versions": [ { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "39f5b4b313b445c980a2a295bed28228c29228ed", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "a2f6ded41bec1d3be643c80a5eb97f1680309001", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "f02edb9debbd36f44efa7567031485892c7df60d", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "e7067a446264a7514fa1cfaa4052cdb6803bc6a2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ksmbd/smb2pdu.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.145", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.25", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.12", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.25" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.2.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/39f5b4b313b445c980a2a295bed28228c29228ed" }, { "url": "https://git.kernel.org/stable/c/a2f6ded41bec1d3be643c80a5eb97f1680309001" }, { "url": "https://git.kernel.org/stable/c/f02edb9debbd36f44efa7567031485892c7df60d" }, { "url": "https://git.kernel.org/stable/c/e7067a446264a7514fa1cfaa4052cdb6803bc6a2" } ], "title": "ksmbd: avoid out of bounds access in decode_preauth_ctxt()", "x_generator": { "engine": "bippy-1.2.0" } } } }