Impact
An attacker can trigger an out-of-bounds (OOB) read in the Linux kernel's ksmbd module [S1]. This typically results in a kernel oops or system crash (Denial of Service), but in some scenarios, it may allow for the disclosure of sensitive information from kernel memory space [S1].
Root Cause
The vulnerability exists in the smb2_sess_setup function within the ksmbd server [S1]. The module fails to correctly handle SMB2 session setup requests when they are encapsulated within a compound request [S1]. Specifically, if the session setup is the second payload in a compound request, ksmbd does not properly validate the bounds of the request data before processing, leading to an out-of-bounds read [S1].
How FixVibe could detect it
FixVibe could detect this vulnerability through its repository scanning capabilities by analyzing the Linux kernel configuration and source code.
- Kernel Configuration Check: FixVibe could identify if the
CONFIG_SMB_SERVER(ksmbd) module is enabled in the target environment's kernel configuration files. - Version Fingerprinting: By checking the kernel version and the specific version of the
ksmbdmodule against known vulnerable ranges (prior to the fix for CVE-2023-3867), FixVibe can flag systems at risk [S1]. - Active Probing: For gated active scans, FixVibe could attempt to negotiate an SMB2 connection and send a specially crafted compound request containing a session setup as the second payload to observe if the server responds with errors indicative of memory corruption or if the connection is abruptly terminated.
Remediation
Users should update their Linux kernel to a version that includes the fix for CVE-2023-3867 [S1]. The fix ensures that ksmbd correctly considers the position of session setup requests within compound requests and validates memory bounds accordingly [S1]. If updates are not immediately possible, disabling the ksmbd module and using alternative SMB implementations like Samba is recommended.