VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Feb 21, 2024· Updated Aug 4, 2026

CVE-2023-52442

CVE-2023-52442

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate session id and tree id in compound request

smb2_get_msg() in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if SMB2_TREE_CONNECT_HE is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Linux/Kernelllm-fuzzy6 versions
    (expand)+ 5 more
    • (no CPE)
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=5.15,<5.15.145
    • cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*
    • (no CPE)range: 5.15
  • osv-coords
    pkg:linux/kernel
    Range: >= 5.15.0, < 5.15.145

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.