CVE-2023-52755 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab out of bounds write in smb_inherit_dacl() slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

References

Link	Providers
https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70
https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb
https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa
https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819
https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb
https://lore.kernel.org/linux-cve-announce/2024052145-CVE-2023-52755-0e00@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52755
https://www.cve.org/CVERecord?id=CVE-2023-52755

History

Mon, 04 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T15:30:42.898Z

Updated: 2025-05-04T07:42:33.718Z

Reserved: 2024-05-21T15:19:24.235Z

Link: CVE-2023-52755

Vulnrichment

Updated: 2024-08-02T23:11:35.921Z

NVD

Status : Analyzed

Published: 2024-05-21T16:15:15.037

Modified: 2025-04-02T14:50:19.830

Link: CVE-2023-52755

Redhat

Severity : Important

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2023-52755 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52755", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T15:19:24.235Z", "datePublished": "2024-05-21T15:30:42.898Z", "dateUpdated": "2025-05-04T07:42:33.718Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T07:42:33.718Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab out of bounds write in smb_inherit_dacl()\n\nslab out-of-bounds write is caused by that offsets is bigger than pntsd\nallocation size. This patch add the check to validate 3 offsets using\nallocation size."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smbacl.c"], "versions": [{"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "aaf0a07d60887d6c36fc46a24de0083744f07819", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "8387c94d73ec66eb597c7a23a8d9eadf64bfbafa", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "09d9d8b40a3338193619c14ed4dc040f4f119e70", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "712e01f32e577e7e48ab0adb5fe550646a3d93cb", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "eebff19acaa35820cb09ce2ccb3d21bee2156ffb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smbacl.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.140", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.64", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.13", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.3", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.5.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819"}, {"url": "https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa"}, {"url": "https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70"}, {"url": "https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb"}, {"url": "https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb"}], "title": "ksmbd: fix slab out of bounds write in smb_inherit_dacl()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "aaf0a07d6088", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "8387c94d73ec", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "09d9d8b40a33", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "712e01f32e57", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "eebff19acaa3", "versionType": "git"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-01T03:55:53.690996Z", "id": "CVE-2023-52755", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T13:46:35.727Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:35.921Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:35.921Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-52755", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-01T03:55:53.690996Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "aaf0a07d6088", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "8387c94d73ec", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "09d9d8b40a33", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "712e01f32e57", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "eebff19acaa3", "versionType": "git"}], "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.271Z"}}], "cna": {"title": "ksmbd: fix slab out of bounds write in smb_inherit_dacl()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "aaf0a07d60887d6c36fc46a24de0083744f07819", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "8387c94d73ec66eb597c7a23a8d9eadf64bfbafa", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "09d9d8b40a3338193619c14ed4dc040f4f119e70", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "712e01f32e577e7e48ab0adb5fe550646a3d93cb", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "eebff19acaa35820cb09ce2ccb3d21bee2156ffb", "versionType": "git"}], "programFiles": ["fs/smb/server/smbacl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.140", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.64", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.13", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6.3", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/server/smbacl.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819"}, {"url": "https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa"}, {"url": "https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70"}, {"url": "https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb"}, {"url": "https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab out of bounds write in smb_inherit_dacl()\n\nslab out-of-bounds write is caused by that offsets is bigger than pntsd\nallocation size. This patch add the check to validate 3 offsets using\nallocation size."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:25:06.441Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52755", "state": "PUBLISHED", "dateUpdated": "2024-12-19T08:25:06.441Z", "dateReserved": "2024-05-21T15:19:24.235Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T15:30:42.898Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A5D0FDE-F72D-44B7-B376-4D382F5A5AE1", "versionEndExcluding": "5.15.140", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D7C884A-CAA2-4EA2-9FEB-5CE776D7B05F", "versionEndExcluding": "6.1.64", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "674C4F82-C336-4B49-BF64-1DE422E889C4", "versionEndExcluding": "6.5.13", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B58252FA-A49C-411F-9B28-DC5FE44BC5A0", "versionEndExcluding": "6.6.3", "versionStartIncluding": "6.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab out of bounds write in smb_inherit_dacl()\n\nslab out-of-bounds write is caused by that offsets is bigger than pntsd\nallocation size. This patch add the check to validate 3 offsets using\nallocation size."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ksmbd: corrige la escritura fuera de los l\u00edmites de slab en smb_inherit_dacl(). La escritura fuera de los l\u00edmites de slab se debe a que las compensaciones son mayores que el tama\u00f1o de asignaci\u00f3n de pntsd. Este parche agrega la verificaci\u00f3n para validar 3 compensaciones usando el tama\u00f1o de asignaci\u00f3n."}], "id": "CVE-2023-52755", "lastModified": "2025-04-02T14:50:19.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-21T16:15:15.037", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}