CVE-2023-6610

Published: 8 December 2023

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

From the Ubuntu Security Team

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information.

Notes

requires CONFIG_CIFS_DEBUG2

while it's true that smb2_dump_detail() only does anything if
CONFIG_CIFS_DEBUG2 is set and a cursory examination of Ubuntu kernel
configs does not show that to be enabled anywhere, part of the fix
also re-orders a message header check in smb2_check_message() which
is called from smb2_check_message(), so there *may* be some impact
here even when CONFIG_CIFS_DEBUG2 is not enabled.

Status

Severity score breakdown

References

• https://access.redhat.com/security/cve/CVE-2023-6610
• https://ubuntu.com/security/notices/USN-6688-1
• https://ubuntu.com/security/notices/USN-6724-1
• https://www.cve.org/CVERecord?id=CVE-2023-6610
• https://ubuntu.com/security/notices/USN-6724-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.kernel.org/show_bug.cgi?id=218219
• https://bugzilla.redhat.com/show_bug.cgi?id=2253614
• https://bugzilla.suse.com/show_bug.cgi?id=1217946