Bugzilla – Bug 1213814
VUL-0: CVE-2023-3866: kernel-source-azure,kernel-source-rt,kernel-source: ksmbd: Chained Request NULL Pointer Dereference Denial-of-Service Vulnerability
Last modified: 2024-05-22 20:26:38 UTC
CVE-2023-3866 This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. The specific flaw exists within the handling of chained requests. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Upstream fix: 5005bcb42191 (ksmbd: validate session id and tree id in the compound request) References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3866 https://www.zerodayinitiative.com/advisories/ZDI-23-979/
Only built on stable which already has the fix, so we should be good
(In reply to Thomas Leroy from comment #1) > Only built on stable which already has the fix, so we should be good commit 5005bcb4219156f1bf7587b185080ec1da08518e [v6.4~32^2] Author: Namjae Jeon <linkinjeon@kernel.org> Date: Thu Jun 15 22:05:29 2023 +0900 ksmbd: validate session id and tree id in the compound request The above fixing patch puts changes on fs/smb/server/server.c. SLE15-SP5 doesn't have this C file because it is introduced by 0626e6641f6b4 since v5.15-rc1. So, yes, 15-SP5 is not affected. And stable branch already included fixing patch 5005bcb42. I still add samba expert, Paulo Alcantara to Cc. But we can close this issue. Reset assigner.
closing