CVE-2023-1194

Published: 3 November 2023

An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.

From the Ubuntu Security Team

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information.

Notes

this affects the KSMBD subsystem, which generally should not
be used, userspace samba is the safer choice.
marking the introduction of the cifsd/ksmbd config option as
the break commit

Status

Severity score breakdown

References

• https://ubuntu.com/security/notices/USN-6725-1
• https://www.cve.org/CVERecord?id=CVE-2023-1194
• https://ubuntu.com/security/notices/USN-6725-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2154176
• https://bugzilla.suse.com/show_bug.cgi?id=1208968