Security readout for executives and security teams
Plain-English summary
A remote, unauthenticated attacker may trigger an out-of-bounds memory read in the Linux kernel’s ksmbd SMB server using a specially formed compound session request. Successful exploitation could expose sensitive kernel memory or disrupt the system. Integrity impact is not claimed by the supplied CVSS assessment.
Executive priority
Treat reachable ksmbd servers as an urgent remediation priority because exploitation requires no authentication and may expose sensitive memory or cause service disruption. Prioritize internet-facing and broadly accessible SMB systems first. Validate exact affected and fixed versions through distribution guidance because the supplied version list is incomplete or ambiguously structured.
Technical view
ksmbd mishandles SMB2 session setup when it appears as the second payload in a compound request. While processing the first payload, smb2_sess_setup() can read beyond its intended memory boundary. The supplied CVSS 3.1 vector rates this network-accessible, low-complexity, unauthenticated flaw at 9.1, with high confidentiality and availability impact.
Likely exposure
Exposure is most likely on Linux systems running ksmbd with SMB reachable by untrusted networks. The supplied affected-version data names 5.15, 5.15.145, 6.1.40, 6.4.5, and 6.5, but does not clearly define complete version ranges. An anomalous “0” entry further limits precise inventory matching.
Exploitation context
The source bundle provides no evidence of active exploitation, and the CVE is not identified as being in KEV. The attack path is nevertheless concerning because the CVSS vector indicates remote exploitation without privileges or user interaction. No public exploit availability is established by the supplied sources.
Researcher notes
The four Linux stable commit references are the available remediation evidence. The bundle provides no CWE classification, exploit telemetry, proof-of-concept status, or clear affected-version range semantics. Researchers should avoid interpreting the listed versions as exhaustive ranges without consulting the corresponding kernel or distribution records.
Mitigation direction
- Install a vendor-supported kernel release incorporating the applicable referenced stable fix.
- Check Linux distribution and kernel vendor advisories for exact fixed package versions.
- Disable ksmbd where SMB service is unnecessary.
- Restrict SMB access to trusted networks until affected systems are remediated.
Validation and detection
- Inventory systems running ksmbd and record their exact kernel package versions.
- Confirm whether SMB is reachable from internet-facing or otherwise untrusted networks.
- Map installed kernels against vendor advisories and the referenced stable commits.
- After updating, verify the running kernel contains the applicable fix.
- Confirm ksmbd remains disabled on systems where it is unnecessary.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-3867 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2LinuxVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/676392184785ace61e939831e7ca44a03d438c3bCVE reference, Linux
- https://git.kernel.org/stable/c/ef572ffa8eb44111eed2925fbb2adca78bdcbf61CVE reference, Linux
- https://git.kernel.org/stable/c/2ba03cecb12ac7ac9e0170e251543c56832d9959CVE reference, Linux
- https://git.kernel.org/stable/c/98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.