Bug 1213814 (CVE-2023-3866) - VUL-0: CVE-2023-3866: kernel-source-azure,kernel-source-rt,kernel-source: ksmbd: Chained Request NULL Pointer Dereference Denial-of-Service Vulnerability
Summary: VUL-0: CVE-2023-3866: kernel-source-azure,kernel-source-rt,kernel-source: ksm...
Status: RESOLVED FIXED
Alias: CVE-2023-3866
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/373726/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-31 10:46 UTC by Thomas Leroy
Modified: 2024-05-22 20:26 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2023-07-31 10:46:17 UTC
CVE-2023-3866

This vulnerability allows remote attackers to create a denial-of-service
condition on affected installations of Linux Kernel. Authentication is not
required to exploit this vulnerability, but only systems with ksmbd enabled are
vulnerable.

The specific flaw exists within the handling of chained requests. The issue
results from dereferencing a NULL pointer. An attacker can leverage this
vulnerability to create a denial-of-service condition on the system.

Upstream fix:
5005bcb42191 (ksmbd: validate session id and tree id in the compound request)

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3866
https://www.zerodayinitiative.com/advisories/ZDI-23-979/
Comment 1 Thomas Leroy 2023-07-31 10:47:15 UTC
Only built on stable which already has the fix, so we should be good
Comment 2 Joey Lee 2023-08-01 04:32:01 UTC
(In reply to Thomas Leroy from comment #1)
> Only built on stable which already has the fix, so we should be good

commit 5005bcb4219156f1bf7587b185080ec1da08518e                 [v6.4~32^2]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Thu Jun 15 22:05:29 2023 +0900

    ksmbd: validate session id and tree id in the compound request

The above fixing patch puts changes on fs/smb/server/server.c. SLE15-SP5 doesn't have this C file because it is introduced by 0626e6641f6b4 since v5.15-rc1. 

So, yes, 15-SP5 is not affected. And stable branch already included fixing patch 5005bcb42.

I still add samba expert, Paulo Alcantara to Cc. But we can close this issue. 

Reset assigner.
Comment 3 Robert Frohl 2024-05-22 20:26:38 UTC
closing