Security readout for executives and security teams
Plain-English summary
A remote, unauthenticated client can provide an oversized session-key length while authenticating to Linux’s ksmbd SMB server, causing memory corruption inside the kernel. The supplied CVSS rating indicates potential loss of confidentiality, integrity, and availability. Systems not using ksmbd are unlikely to expose the vulnerable code path.
Executive priority
Treat internet-facing or broadly reachable ksmbd servers as an urgent patching priority because kernel memory corruption occurs before authentication. Validate exposure immediately, then deploy vendor-supported fixed kernels through emergency change procedures. Systems without active ksmbd can receive lower priority after that condition is verified.
Technical view
CVE-2023-52440 is a SLUB overflow in ksmbd_decode_ntlmssp_auth_blob(). The code failed to ensure authblob->SessionKey.Length fit the CIFS_KEY_SIZE destination before cifs_arc4_crypt copied client-controlled session-key data. The network-accessible authentication path requires neither privileges nor user interaction according to CVSS 3.1.
Likely exposure
Prioritize Linux systems running ksmbd and accepting SMB connections from untrusted networks. The supplied affected-version data is irregular and includes release numbers plus commit identifiers, so version strings alone may misclassify distribution kernels with backported fixes. Confirm exposure through kernel vendor advisories and patch provenance.
Exploitation context
The source bundle reports CVSS 9.8 with network access, low complexity, no required privileges, and no user interaction. It does not provide evidence of public exploitation or a working exploit, and KEV is false. Active exploitation should therefore not be claimed.
Researcher notes
The documented defect is a missing upper-bound check on a client-supplied NTLMSSP SessionKey length before copying into a fixed CIFS_KEY_SIZE array. Multiple stable-branch commits are supplied. The bundle does not establish exploitability beyond the overflow and CVSS assessment, so specific outcomes such as reliable code execution should not be asserted.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Confirm distribution backports using vendor advisories or kernel package changelogs.
- Until patched, restrict untrusted network access to systems providing ksmbd SMB service.
- If ksmbd is unnecessary, consult vendor guidance about safely disabling it.
Validation and detection
- Inventory Linux hosts, running kernel versions, and distribution package revisions.
- Determine whether ksmbd is active and reachable from untrusted network segments.
- Verify the installed kernel contains the relevant stable fix or documented vendor backport.
- After updating, confirm the new kernel is running and SMB functionality remains healthy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-52440 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bd554ed4fdc3d38404a1c43d428432577573e809CVE reference, Linux
- https://git.kernel.org/stable/c/30fd6521b2fbd9b767e438e31945e5ea3e3a2fbaCVE reference, Linux
- https://git.kernel.org/stable/c/7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4CVE reference, Linux
- https://git.kernel.org/stable/c/ecd7e1c562cb08e41957fcd4b0e404de5ab38e20CVE reference, Linux
- https://git.kernel.org/stable/c/4b081ce0d830b684fdf967abc3696d1261387254CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.