ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr

{
  "id": "b55725dbfe2f9616478994ef1e8e8f092891e00115122cd57f52dda1ae2dab24",
  "url": "https://osv.dev/vulnerability/CVE-2023-54203",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it. [ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 411.400452] CIFS: Attempting to mount \\\\192.168.45.139\\homes [ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 [ 411.479323] ================================================================== [ 411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 [ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE 6.1.21 #3 [ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 411.479425] Call Trace: [ 411.479428] [ 411.479432] dump_stack_lvl+0x49/0x63 [ 411.479444] print_report+0x171/0x4a8 [ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 [ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411",
    "evidence": "osv:CVE-2023-54203",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.145",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.24",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.2.11",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CVE-2023-54203",
      "aliases": [
        "CVE-2023-54203"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "51a8534c0f35c0401e45f1055f914729cad98bf9"
                },
                {
                  "fixed": "921536046bd165efeb07beef5630aff35cd6a489"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0b3ec5671ac06829ccebdaeec05acedfec327f42"
                },
                {
                  "fixed": "a8334a0c535d0f0b4d64926c8fe0922ed98f7d43"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "cc32cd98a0aee4cc3eb611cbce11795b1aaa738a"
                },
                {
                  "fixed": "99a51c673b1d2d0b5a972353401b77612d9cc713"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "39b291b86b5988bf8753c3874d5c773399d09b96"
                },
                {
                  "fixed": "dc8289f912387c3bcfbc5d2db29c8947fa207c11"
                }
              ]
            }
          ],
          "versions": [
            "v5.15.144",
            "v5.15.143",
            "v5.15.142",
            "v5.15.141",
            "v5.15.140",
            "v5.15.139",
            "v5.15.138",
            "v5.15.137",
            "v5.15.136",
            "v5.15.135",
            "v5.15.134",
            "v5.15.133",
            "v5.15.132",
            "v5.15.131",
            "v5.15.130",
            "v5.15.129",
            "v5.15.128",
            "v5.15.127",
            "v5.15.126",
            "v5.15.125",
            "v5.15.124",
            "v5.15.123",
            "v5.15.122",
            "v5.15.121",
            "v5.15.120",
            "v5.15.119",
            "v5.15.118",
            "v5.15.117",
            "v5.15.116",
            "v5.15.115",
            "v5.15.114",
            "v5.15.113",
            "v5.15.112",
            "v5.15.111",
            "v5.15.110",
            "v5.15.109",
            "v5.15.108",
            "v5.15.107",
            "v5.15.106",
            "v5.15.105",
            "v6.1.23",
            "v6.1.22",
            "v6.2.10",
            "v6.2.9"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54203.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.15.105"
                },
                {
                  "fixed": "5.15.145"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.1.22"
                },
                {
                  "fixed": "6.1.24"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.9"
                },
                {
                  "fixed": "6.2.11"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54203.json"
          }
        }
      ],
      "modified": "2026-10-30T02:30:33.585013982Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/921536046bd165efeb07beef5630aff35cd6a489",
        "https://git.kernel.org/stable/c/99a51c673b1d2d0b5a972353401b77612d9cc713",
        "https://git.kernel.org/stable/c/a8334a0c535d0f0b4d64926c8fe0922ed98f7d43",
        "https://git.kernel.org/stable/c/dc8289f912387c3bcfbc5d2db29c8947fa207c11",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54203.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-54203",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54203.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-54203",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504472,
  "published_at": "2025-12-30T12:09:07.538+00:00"
}