CVE-2023-3865
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-3865
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3865.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-3865
- Downstream
- Published
- 2025-08-16T13:27:56Z
- Modified
- 2025-10-21T14:08:03.365251Z
- Summary
- ksmbd: fix out-of-bound read in smb2_write
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bound read in smb2_write
ksmbdsmb2checkmessage doesn't validate hdr->NextCommand. If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow oversized smb2 write length. It will cause OOB read in smb2write.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/3813eee5154d6a4c5875cb4444cb2b63bac8947f
- https://git.kernel.org/stable/c/58a9c41064df27632e780c5a3ae3e0e4284957d1
- https://git.kernel.org/stable/c/5fe7f7b78290638806211046a99f031ff26164e1
- https://git.kernel.org/stable/c/c86211159bc3178b891e0d60e586a32c7b6a231b
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0626e6641f6b467447c81dd7678a69c66f7746cfFixed3813eee5154d6a4c5875cb4444cb2b63bac8947f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0626e6641f6b467447c81dd7678a69c66f7746cfFixedc86211159bc3178b891e0d60e586a32c7b6a231b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0626e6641f6b467447c81dd7678a69c66f7746cfFixed58a9c41064df27632e780c5a3ae3e0e4284957d1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0626e6641f6b467447c81dd7678a69c66f7746cfFixed5fe7f7b78290638806211046a99f031ff26164e1
Affected versions
v5.*
v5.13
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.100
v5.15.101
v5.15.102
v5.15.103
v5.15.104
v5.15.105
v5.15.106
v5.15.107
v5.15.108
v5.15.109
v5.15.11
v5.15.110
v5.15.111
v5.15.112
v5.15.113
v5.15.114
v5.15.115
v5.15.116
v5.15.117
v5.15.118
v5.15.119
v5.15.12
v5.15.120
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.45
v5.15.46
v5.15.47
v5.15.48
v5.15.49
v5.15.5
v5.15.50
v5.15.51
v5.15.52
v5.15.53
v5.15.54
v5.15.55
v5.15.56
v5.15.57
v5.15.58
v5.15.59
v5.15.6
v5.15.60
v5.15.61
v5.15.62
v5.15.63
v5.15.64
v5.15.65
v5.15.66
v5.15.67
v5.15.68
v5.15.69
v5.15.7
v5.15.70
v5.15.71
v5.15.72
v5.15.73
v5.15.74
v5.15.75
v5.15.76
v5.15.77
v5.15.78
v5.15.79
v5.15.8
v5.15.80
v5.15.81
v5.15.82
v5.15.83
v5.15.84
v5.15.85
v5.15.86
v5.15.87
v5.15.88
v5.15.89
v5.15.9
v5.15.90
v5.15.91
v5.15.92
v5.15.93
v5.15.94
v5.15.95
v5.15.96
v5.15.97
v5.15.98
v5.15.99
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v6.*
v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.1.8
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.3.8
v6.3.9
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
Database specific
vanir_signatures
[
{
"id": "CVE-2023-3865-114985fa",
"target": {
"file": "fs/smb/server/smb2misc.c"
},
"digest": {
"line_hashes": [
"65861777456873217949548936954018488448",
"194818727358481069214870902578106303554",
"147814911490503710360716464222567326102",
"328559044649179413152225796598263802584",
"72330297102624744193736805501399492316",
"122402358743054881596345628497648659300"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fe7f7b78290638806211046a99f031ff26164e1"
},
{
"id": "CVE-2023-3865-1679ca4f",
"target": {
"file": "fs/ksmbd/smb2misc.c"
},
"digest": {
"line_hashes": [
"65861777456873217949548936954018488448",
"194818727358481069214870902578106303554",
"147814911490503710360716464222567326102",
"328559044649179413152225796598263802584",
"72330297102624744193736805501399492316",
"122402358743054881596345628497648659300"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3813eee5154d6a4c5875cb4444cb2b63bac8947f"
},
{
"id": "CVE-2023-3865-1afb2cee",
"target": {
"file": "fs/ksmbd/smb2misc.c"
},
"digest": {
"line_hashes": [
"65861777456873217949548936954018488448",
"194818727358481069214870902578106303554",
"147814911490503710360716464222567326102",
"328559044649179413152225796598263802584",
"72330297102624744193736805501399492316",
"122402358743054881596345628497648659300"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58a9c41064df27632e780c5a3ae3e0e4284957d1"
},
{
"id": "CVE-2023-3865-373103c3",
"target": {
"function": "ksmbd_smb2_check_message",
"file": "fs/ksmbd/smb2misc.c"
},
"digest": {
"length": 1847.0,
"function_hash": "158883956343731350605146585512394491142"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c86211159bc3178b891e0d60e586a32c7b6a231b"
},
{
"id": "CVE-2023-3865-9d2eca83",
"target": {
"function": "ksmbd_smb2_check_message",
"file": "fs/ksmbd/smb2misc.c"
},
"digest": {
"length": 1847.0,
"function_hash": "158883956343731350605146585512394491142"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58a9c41064df27632e780c5a3ae3e0e4284957d1"
},
{
"id": "CVE-2023-3865-c3c62a49",
"target": {
"function": "ksmbd_smb2_check_message",
"file": "fs/ksmbd/smb2misc.c"
},
"digest": {
"length": 1847.0,
"function_hash": "158883956343731350605146585512394491142"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3813eee5154d6a4c5875cb4444cb2b63bac8947f"
},
{
"id": "CVE-2023-3865-d4526ef0",
"target": {
"file": "fs/ksmbd/smb2misc.c"
},
"digest": {
"line_hashes": [
"65861777456873217949548936954018488448",
"194818727358481069214870902578106303554",
"147814911490503710360716464222567326102",
"328559044649179413152225796598263802584",
"72330297102624744193736805501399492316",
"122402358743054881596345628497648659300"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c86211159bc3178b891e0d60e586a32c7b6a231b"
},
{
"id": "CVE-2023-3865-df43687c",
"target": {
"function": "ksmbd_smb2_check_message",
"file": "fs/smb/server/smb2misc.c"
},
"digest": {
"length": 1847.0,
"function_hash": "158883956343731350605146585512394491142"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fe7f7b78290638806211046a99f031ff26164e1"
}
]