Security readout for executives and security teams
Plain-English summary
A remote user with limited privileges may be able to make Linux's ksmbd SMB server read beyond intended memory boundaries. This creates potential data-disclosure and service-disruption risk. Exposure is limited to systems using affected kernels with ksmbd enabled and reachable.
Executive priority
Treat this as a high-priority, targeted kernel remediation. Promptly identify internet-facing or broadly reachable ksmbd servers and patch them first. The absence of cited active exploitation lowers emergency pressure, but the potential confidentiality and availability impact warrants timely action.
Technical view
ksmbd_smb2_check_message fails to validate the SMB2 NextCommand value against the write Offset and Length. An oversized value can therefore permit an excessive SMB2 write length, leading smb2_write to perform an out-of-bounds read. The supplied CVSS 3.1 score is 8.1, reflecting high confidentiality and availability impact.
Likely exposure
Prioritize Linux systems running ksmbd and accepting SMB connections. The bundle lists 5.15, 5.15.121, 6.1.36, 6.3.10, and 6.4 as affected, but its version data contains ambiguities. Confirm exact affected and fixed package boundaries with the applicable Linux distributor.
Exploitation context
The supplied record does not list this CVE in CISA KEV and provides no cited evidence of public or active exploitation. The CVSS vector indicates network access, low complexity, low privileges, and no user interaction, but that describes theoretical exploit conditions rather than observed attacks.
Researcher notes
The defect concerns validation of a compound SMB2 message boundary, specifically NextCommand relative to write Offset and Length. Four stable-kernel commits are referenced as fixes. The supplied version representation is insufficient for reliable distribution-level package decisions, and no CWE, exploit details, or attack telemetry are provided.
Mitigation direction
- Update to a distribution-supported kernel confirmed to contain the referenced ksmbd fix.
- Check Linux distributor guidance for exact fixed packages and reboot requirements.
- Prioritize remediation where ksmbd is enabled and reachable from untrusted networks.
- Consider temporarily restricting unneeded ksmbd access after reviewing operational dependencies.
Validation and detection
- Inventory active kernel versions and identify systems where ksmbd is enabled.
- Determine whether affected ksmbd services accept connections from untrusted networks.
- Compare kernel package changelogs against distributor guidance and the referenced fix commits.
- After updating, verify the fixed kernel is running following any required reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-3865 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3813eee5154d6a4c5875cb4444cb2b63bac8947fCVE reference, Linux
- https://git.kernel.org/stable/c/c86211159bc3178b891e0d60e586a32c7b6a231bCVE reference, Linux
- https://git.kernel.org/stable/c/58a9c41064df27632e780c5a3ae3e0e4284957d1CVE reference, Linux
- https://git.kernel.org/stable/c/5fe7f7b78290638806211046a99f031ff26164e1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.