From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A225E153BD9 for ; Sat, 16 Aug 2025 13:28:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755350887; cv=none; b=Jnyj5JGnYcBrNKnxfll8KGk/zC8W4psmna93WvSk5k+trdFWLIP9TsAlbWBqpky0WH+nnAc8LrjoWZwi+Ph7DFKT934I7blCxlXvPGb/CK2f/0xhdLrHRp/C22LGj4NNVjz7eb5TxzI3wCssgtyMbfYfd8tanW4SEjUfuvBes/s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755350887; c=relaxed/simple; bh=/BImKfYZ1KdpegXL8A7auJvYbKR4HMnZQV+wKhn0yoU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CPmxRF+9RdY3ZFKEonHLQMCSDT6ZV16o3fYwBLYizo7NqnzNmAGXRvEKXtND1Ss94gJziFQKxjBW4m0MwIvFqeYFFchnVRJO9HckFZzubizFoOLV2zdeAul1rk/djVD7IVr6CYwpFdlVN7psY7Wfbxom9RokAayrAyZW2FSrw0k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ebMVY3Am; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ebMVY3Am" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FFDCC4CEEF; Sat, 16 Aug 2025 13:28:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1755350887; bh=/BImKfYZ1KdpegXL8A7auJvYbKR4HMnZQV+wKhn0yoU=; h=From:To:Cc:Subject:Date:Reply-to:From; b=ebMVY3AmMtqDw6copvvPy/HxhRmi7E3FDciTcKbgzWP5zDXg+UYZmJ/cdJuidg6+D 3YW1NoiCognbrQsd6POarGE0rbU1p9rCRRkQZqM7H6fKkhXIiLd6gfjxnKYIonCDzI DZ8t9BnPfg7OqYp5EIIekehVTXGEE6nPsLH9gZtA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-3866: ksmbd: validate session id and tree id in the compound request Date: Sat, 16 Aug 2025 15:28:03 +0200 Message-ID: <2025081602-CVE-2023-3866-d99e@gregkh> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2235; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=LfDSo0LuV0apuPNI7Pwd6HQSRsXt2S7m+slXvTK0jLY=; b=owGbwMvMwCRo6H6F97bub03G02pJDBkL2pNamhgc3A7xneXOCH+2qK66dWnCLM4u7h2s370NV k3acjCnI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACYi/JVhrqA9y3u7Y1u28d4v Usgu/1TuVrfuBsNc6f26fKoJzw+G3bz01nFixPuvhg8zAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error. The Linux kernel CVE team has assigned CVE-2023-3866 to this issue. Affected and fixed versions =========================== Fixed in 5.15.121 with commit eb947403518ea3d93f6d89264bb1f5416bb0c7d0 Fixed in 6.1.36 with commit 854156d12caa9d36de1cf5f084591c7686cc8a9d Fixed in 6.3.10 with commit d1066c1b3663401cd23c0d6e60cdae750ce00c0f Fixed in 6.4 with commit 5005bcb4219156f1bf7587b185080ec1da08518e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-3866 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/smb/server/server.c fs/smb/server/smb2pdu.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/eb947403518ea3d93f6d89264bb1f5416bb0c7d0 https://git.kernel.org/stable/c/854156d12caa9d36de1cf5f084591c7686cc8a9d https://git.kernel.org/stable/c/d1066c1b3663401cd23c0d6e60cdae750ce00c0f https://git.kernel.org/stable/c/5005bcb4219156f1bf7587b185080ec1da08518e