CVE - CVE-2023-52442

CVE-ID
CVE-2023-52442	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 URL:https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 MISC:https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e URL:https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e MISC:https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac URL:https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac MISC:https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f URL:https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f
Assigning CNA
kernel.org
Date Record Created
20240220	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240220)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)