{
  "threat_severity" : "Moderate",
  "public_date" : "2024-02-20T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: smb: client: fix potential OOBs in smb2_parse_contexts()",
    "id" : "2265285",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2265285"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
    "status" : "verified"
  },
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix potential OOBs in smb2_parse_contexts()\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\nThis fixes following oops when accessing invalid create contexts from\nserver:\nBUG: unable to handle page fault for address: ffff8881178d8cc3\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 4a01067 P4D 4a01067 PUD 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\nRIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\nCode: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7\n7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\nRSP: 0018:ffffc900007939e0 EFLAGS: 00010216\nRAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\nRDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\nRBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\nR10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\nR13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\nFS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n<TASK>\n? __die+0x23/0x70\n? page_fault_oops+0x181/0x480\n? search_module_extables+0x19/0x60\n? srso_alias_return_thunk+0x5/0xfbef5\n? exc_page_fault+0x1b6/0x1c0\n? asm_exc_page_fault+0x26/0x30\n? smb2_parse_contexts+0xa0/0x3a0 [cifs]\nSMB2_open+0x38d/0x5f0 [cifs]\n? smb2_is_path_accessible+0x138/0x260 [cifs]\nsmb2_is_path_accessible+0x138/0x260 [cifs]\ncifs_is_path_remote+0x8d/0x230 [cifs]\ncifs_mount+0x7e/0x350 [cifs]\ncifs_smb3_do_mount+0x128/0x780 [cifs]\nsmb3_get_tree+0xd9/0x290 [cifs]\nvfs_get_tree+0x2c/0x100\n? capable+0x37/0x70\npath_mount+0x2d7/0xb80\n? srso_alias_return_thunk+0x5/0xfbef5\n? _raw_spin_unlock_irqrestore+0x44/0x60\n__x64_sys_mount+0x11a/0x150\ndo_syscall_64+0x47/0xf0\nentry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f8737657b1e", "A flaw was found in the smb client in the Linux kernel. A potential out-of-bounds error was seen in the smb2_parse_contexts() function. Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts()." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:2950",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.rt7.342.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:3138",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2024-08-21T00:00:00Z",
    "advisory" : "RHSA-2024:5692",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.6",
    "package" : "kernel-0:4.18.0-372.119.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2024-08-21T00:00:00Z",
    "advisory" : "RHSA-2024:5692",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.6",
    "package" : "kernel-0:4.18.0-372.119.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2024-08-21T00:00:00Z",
    "advisory" : "RHSA-2024:5692",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.6",
    "package" : "kernel-0:4.18.0-372.119.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:6993",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.8",
    "package" : "kernel-0:4.18.0-477.74.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2394",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.13.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2394",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.13.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-07-09T00:00:00Z",
    "advisory" : "RHSA-2024:4415",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "kernel-0:5.14.0-70.105.1.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-07-09T00:00:00Z",
    "advisory" : "RHSA-2024:4412",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0::nfv",
    "package" : "kernel-rt-0:5.14.0-70.105.1.rt21.177.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-07-24T00:00:00Z",
    "advisory" : "RHSA-2024:4823",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "kernel-0:5.14.0-284.75.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-07-24T00:00:00Z",
    "advisory" : "RHSA-2024:4831",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.75.1.rt14.360.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-52434\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52434\nhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=17a0f64cc02d4972e21c733d9f21d1c512963afa\nhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=af1689a9b7701d9907dfc84d2a4b57c4bc907144\nhttps://lore.kernel.org/linux-cve-announce/2024022033-makeshift-flammable-cb72@gregkh/T/#u" ],
  "name" : "CVE-2023-52434",
  "mitigation" : {
    "value" : "To mitigate this issue, prevent module cifs from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.",
    "lang" : "en:us"
  },
  "csaw" : false
}