Security readout for executives and security teams
Plain-English summary
A malformed SMB extended-attribute request can cause Linux's ksmbd server to access memory outside the intended buffer. The supplied severity data indicates possible kernel-data exposure or system failure. Only systems using ksmbd on an affected kernel are exposed; ordinary Linux systems without this service are not affected through this path.
Executive priority
Prioritize prompt remediation on reachable ksmbd servers, especially those accessible by untrusted users or networks. Systems without ksmbd have substantially lower urgency for this specific flaw. The high CVSS score supports accelerated patching, although the supplied evidence does not justify claiming an active exploitation emergency.
Technical view
smb2_set_ea() follows NextEntryOffset while processing multiple FILE_FULL_EA_INFORMATION entries. It validated the next entry using the current entry's offset rather than the total buffer length, permitting out-of-bounds access. CVSS 3.1 scores this 8.1: network-accessible, low complexity, low privileges, no user interaction, with high confidentiality and availability impact.
Likely exposure
Exposure is limited to systems running ksmbd on an affected Linux kernel. The supplied version data references 5.15 and several 6.x points but does not clearly define downstream package ranges. Confirm remediation through distribution backport information or inclusion of the applicable stable-kernel commit.
Exploitation context
The bundle does not list this CVE in KEV, and no supplied source establishes active exploitation or a public exploit. The CVSS vector indicates a network attacker with low privileges could attempt exploitation without user interaction. Actual reachability depends on ksmbd being active and accessible to the attacker.
Researcher notes
The source describes incorrect bounds validation but supplies no CWE or confirmed exploitation evidence. Four stable commits appear to cover different maintained kernel branches; applicability must be matched to the deployed branch or downstream backport. The supplied affected-version array is ambiguous, so do not infer safety from version numbers alone.
Mitigation direction
- Upgrade to a vendor-supported kernel release containing the applicable upstream stable fix.
- Confirm your distribution's kernel package backports one of the cited stable commits.
- Until updated, restrict ksmbd access to trusted networks and accounts, following vendor guidance.
- Disable ksmbd where the kernel SMB server is not operationally required.
Validation and detection
- Determine whether ksmbd is enabled, loaded, and accepting SMB connections.
- Record exact kernel and distribution package versions across reachable hosts.
- Verify the running kernel includes the applicable stable commit or distributor backport.
- Identify low-privileged accounts and networks able to reach each ksmbd service.
- Review kernel logs for ksmbd faults; their absence does not establish non-exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-4130 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/aeb974907642be095e38ecb1a400ca583958b2b0CVE reference, Linux
- https://git.kernel.org/stable/c/f339d76a3a972601d0738b881b099d49ebbdc3a2CVE reference, Linux
- https://git.kernel.org/stable/c/4bf629262f9118ee91b1c3a518ebf2b3bcb22180CVE reference, Linux
- https://git.kernel.org/stable/c/79ed288cef201f1f212dfb934bcaac75572fb8f6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.