CVE-2023-52442

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-52442
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52442.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52442
Downstream
Published
2024-02-21T07:21:01.814Z
Modified
2026-03-14T12:16:45.868554Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ksmbd: validate session id and tree id in compound request
Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate session id and tree id in compound request

smb2_get_msg() in smb2getksmbdtcon() and smb2checkusersession() will always return the first request smb2 header in a compound request. if SMB2_TREE_CONNECT_HE is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbdreqbuf_next() to get current command in compound.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52442.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0626e6641f6b467447c81dd7678a69c66f7746cf
Fixed
017d85c94f02090a87f4a473dbe0d6ee0da72693
Fixed
becb5191d1d5fdfca0198a2e37457bbbf4fe266f
Fixed
4c2b350b2e269e3fd17bbfa42de1b42775b777ac
Fixed
3df0411e132ee74a87aa13142dfd2b190275332e

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52442.json"