CVE-2023-38428

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.4

Description The issue is related to the function session user() in the fs/ksmbd/smb2pdu.c module of the Linux kernel's KSMBD file system. It involves an out-of-bounds read due to improper checking of the UserName value, which does not consider the address of the security buffer. This could allow a remote attacker to access protected information or cause a denial of service.

Recommendations For Linux kernel versions prior to 6.3.4, update to version 6.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the fs/ksmbd/smb2pdu.c module until a patch is available. Avoid using the UserName value in the affected session user() function until the issue is resolved.