What’s Vulnerable › Vulnerabilities

CVE-2023-52442: ksmbd: validate session id and tree id in compound request

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 29.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-21 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

Affected products

• Linux kernel: from 5.15 before 5.15.145; from 5.16 before 6.1.53; from 6.2 before 6.4.16; 6.5-rc1, 6.5-rc2, 6.5-rc3 — fixed in 5.15.145, 6.1.53, 6.4.16

How to fix

Upgrade to a fixed version: Linux kernel 5.15.145, 6.1.53, 6.4.16. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693
• https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e
• https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac
• https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f
• https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693
• https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e
• https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac
• https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f

Get alerted when CVE-2023-52442 or the next vulnerability affects your stack