8.1

CVE-2023-52434: smb: client: fix potential OOBs in smb2_parse_contexts()

Modified
AliasesUBUNTU-CVE-2023-52434DEBIAN-CVE-2023-52434
Published 20-02-2024Last modified 05-08-2026

Vulnerability summary

CVE-2023-52434 is a high (CVSS 8.1) vulnerability in debian debian_linux. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
1.02%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 36 · Related 25
DLA-3842-1DSA-5681-1RHSA-2024:2394RHSA-2024:2950RHSA-2024:3138RHSA-2024:4412

Timeline

  1. 20-02-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260 [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs] cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

1.02%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.02% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu112 products
  • linux< 5.4.0-192.212 | < 5.15.0-112.122
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1130.140 | < 5.15.0-1063.69
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ b8c32dbb0deb287a5fcb78251e4eae6c7275760d, < 6726429c18c62dbf5e96ebbd522f262e016553fb | ≥ b8c32dbb0deb287a5fcb78251e4eae6c7275760d, < 13fb0fc4917621f3dfa285a27eaf7151d770b5e5 | ≥ b8c32dbb0deb287a5fcb78251e4eae6c7275760d, < 890bc4fac3c0973a49cac35f634579bebba7fe48 | ≥ b8c32dbb0deb287a5fcb78251e4eae6c7275760d, < 1ae3c59355dc9882e09c020afe8ffbd895ad0f29 | ≥ b8c32dbb0deb287a5fcb78251e4eae6c7275760d, < 17a0f64cc02d4972e21c733d9f21d1c512963afa | ≥ b8c32dbb0deb287a5fcb78251e4eae6c7275760d, < af1689a9b7701d9907dfc84d2a4b57c4bc907144 | 3.7
  • linux_kernel≥ 5.3, < 5.4.277 | ≥ 5.5, < 5.10.211 | ≥ 5.11, < 5.15.150 | ≥ 5.16, ≤ 6.1.79 | ≥ 6.2, < 6.6.8 | 6.7:rc1 | 6.7:rc2 | 6.7:rc3 | 6.7:rc4 | 6.7:rc5

3 vendors · 116 products

References

33 links
Show all 33 references