CVE-2023-4130

Published Aug 16, 2025

Last updated 17 days ago

Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-4130 is a vulnerability in the Linux kernel, specifically within the ksmbd server implementation when handling FILE_FULL_EA_INFORMATION requests. The flaw occurs in the `smb2_set_ea()` function, where multiple `smb2_ea_info` buffers are processed using the `NextEntryOffset` field. The ksmbd incorrectly validates the length of the next extended attribute (EA) buffer by using the next offset instead of the actual buffer length (`buf_len`). Because "next" represents the offset of the current EA rather than the remaining buffer size, this mistake could lead to an out-of-bounds access when parsing subsequent entries.

Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Analyzed
Products: linux_kernel

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "73A72E27-1F7D-4EF0-B826-78FD0D86735C",
            "versionEndExcluding": "5.15.127",
            "versionStartIncluding": "5.15"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D8B8CC90-9492-465C-81D4-10DA3B712286",
            "versionEndExcluding": "6.1.46",
            "versionStartIncluding": "5.16"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C36FD9E6-B6D7-4887-8F08-C1F64E139D5C",
            "versionEndExcluding": "6.4.11",
            "versionStartIncluding": "6.2"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0B3E6E4D-E24E-4630-B00C-8C9901C597B0"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F5608371-157A-4318-8A2E-4104C3467EA1"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2226A776-DF8C-49E0-A030-0A7853BB018A"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6F15C659-DF06-455A-9765-0E6DE920F29A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.