Linux Distros Unpatched Vulnerability : CVE-2023-52442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2getmsg in smb2getksmbdtcon an...

CVE-2023-52442

CVE-2023-52442 is a Linux kernel/KSMBD issue where smb2_get_msg() could return the first command in a compound request, skipping the tree-id check if SMB2_TREE_CONNECT_HE is first. The patch fixes the logic by using ksmbd_req_buf_next() to fetch the current command within a compound request (smb2...

CVE-2023-52442 ksmbd: validate session id and tree id in compound request

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2getmsg in smb2getksmbdtcon and smb2checkusersession will always return the first request smb2 header in a compound request. if SMB2TREECONNECTHE is the first command ...