Security readout for executives and security teams
Plain-English summary
A remotely reachable Linux SMB server using ksmbd can mishandle a specific protocol transition and access memory outside its intended bounds. The supplied CVSS assessment anticipates serious confidentiality and availability consequences, although the sources do not specify the exact failure outcome. Systems not running or exposing ksmbd are unlikely to be directly exposed.
Executive priority
Inventory ksmbd usage immediately and urgently remediate reachable instances, especially those exposed beyond trusted networks. The technical severity is critical, but current sources do not establish active exploitation. Systems without ksmbd enabled can be deprioritized after verification.
Technical view
After an SMB2 negotiate request sets need_neg to false, a later SMB1 negotiate request can incorrectly reach init_smb2_rsp_hdr(), causing an out-of-bounds condition. The CVSS vector describes unauthenticated, low-complexity network access without user interaction. The fix ignores SMB1 packets after negotiation state has changed.
Likely exposure
Highest exposure is on Linux systems running ksmbd with SMB reachable from untrusted networks. The bundle identifies affected 5.15, 6.1, 6.4, and 6.5-related versions, but its version formatting does not establish reliable range boundaries. Confirm exposure using distribution advisories and inclusion of the applicable stable fix.
Exploitation context
The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit. The vulnerable path is remotely reachable before authentication according to the CVSS vector. Treat exposed ksmbd services urgently, but do not interpret the critical score alone as proof of exploitation.
Researcher notes
The disclosed state error crosses SMB protocol handling after negotiation and produces an out-of-bounds condition. The bundle does not identify a CWE, exact memory primitive, crash signature, or demonstrated information disclosure. Four stable-kernel commits are supplied, suggesting branch-specific backports; determine the applicable commit through kernel or distribution provenance.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Prioritize internet-reachable or broadly accessible ksmbd servers for remediation.
- Restrict SMB access to trusted networks while updates are pending.
- Disable ksmbd where SMB file sharing is unnecessary.
- Check Linux distribution guidance for precise fixed package versions.
Validation and detection
- Confirm whether ksmbd is enabled or loaded on each Linux host.
- Identify which networks can reach the host's SMB service.
- Compare installed kernels with vendor advisories and applicable fix commits.
- Review system logs for unexplained ksmbd faults or SMB negotiation failures.
- After updating, verify the running kernel contains the vendor-provided correction.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-52441 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2LinuxVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40bCVE reference, Linux
- https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bcCVE reference, Linux
- https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895fCVE reference, Linux
- https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.