Linux Distros Unpatched Vulnerability : CVE-2023-52442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2getmsg in smb2getksmbdtcon an...

CVE-2023-52442 ksmbd: validate session id and tree id in compound request

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2getmsg in smb2getksmbdtcon and smb2checkusersession will always return the first request smb2 header in a compound request. if SMB2TREECONNECTHE is the first command ...

CVE-2023-52442

CVE-2023-52442 concerns the Linux kernel KSMBD SMB server. The issue arises in compound SMB2 requests where smb2_get_msg() would return the first command header, causing the tree ID check to be skipped if SMB2_TREE_CONNECT_HE is first. The root cause is incorrect command selection within a compou...