CVE-2023-4458 Linux Kernel ksmbd Out-Of-Bounds Read Information Disclosure

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Linux Kernel ksmbd smb2_open Out-Of-Bounds Read Information Disclosure Vulnerability 2. Vulnerability ID: ZDI-24-590, ZDI-CAN-21824 3. CVE ID: CVE-2023-4458 4. CVSS Score: 4.0 5. Affected Vendor: Linux 6. Affected Product: Kernel 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to disclose sensitive information on affected Linux Kernel installations. - Exploitation may not require authentication, depending on configuration. - Only systems with ksmbd enabled are affected. - The issue lies in the parsing of extended attributes; due to insufficient validation of user-supplied data, it may lead to reading beyond the end of an allocated buffer. - Attackers could leverage this vulnerability in combination with other flaws to execute arbitrary code in kernel context. 8. Additional Details: - Linux has released updates to fix this vulnerability. - More details are available at the following link: https://lore.kernel.org/all/20230825144848.9034-1-linkinjeon@kernel.org/ 9. Disclosure Timeline: - 2023-08-17: Vulnerability reported to vendor - 2024-06-10: Coordinated public disclosure of vulnerability advisory - 2024-07-01: Vulnerability advisory updated 10. Credit: HexRabbit (@h3xr4bb1t) This information provides a detailed description of the vulnerability, including its scope of impact, exploitation methods, and remediation steps.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-4458 Linux Kernel ksmbd Out-Of-Bounds Read Information Disclosure