CRITICAL 9.1 Microsoft

CVE-2023-38431

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes via pdu_size in ksmbd_conn_handler_loop leading to an out-of-bounds read.

Microsoft Security Update 2023-Jul: An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes via pdu_size in ksmbd_conn_handler_loop leading to an out-of-bounds read.

Affected Products

References

Published: 2023-07-11 · Source: Microsoft · Feed updated: 2026-10-31
This critical severity vulnerability with a CVSS score of 9.1 was published on 2023-07-11 via Microsoft. Affected: cm1 kernel 5.10.188.1-1 on CBL Mariner 1.0, cbl2 kernel 5.15.122.1-2 on CBL Mariner 2.0.

Risk Timeline

CVE Disclosed2023-07-11 · 1207 days ago

Remediation Resources

Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38431
NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2023-38431

Related Vulnerabilities

CVETitleSeverityCVSS
CVE-2023-38408 PoCThe PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently tCRITICAL9.8
CVE-2023-38427An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.CRITICAL9.8
CVE-2023-38429An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c CRITICAL9.8
CVE-2023-38426An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-boCRITICAL9.1
CVE-2023-38428An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in CRITICAL9.1
CVE-2023-38430An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validatCRITICAL9.1
vulnfeed aggregates 18441 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.