‹ Back to list

CVE-2023-52440

Status: ModifiedHigh (7.8)—PoC
Severity7.8High · CVSS 3.1
Exploitation probability22 %higher than 98% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailableProof of concept on GitHub (unverified)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

CVSS

Base score
7.8
Version
3.1
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
22 %
Percentile among all scored CVEs
98
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Linux — Linux Kernel

CWEs

References

Show 10 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-52440",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-52440",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T16:02:52.628151Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c5049d2d73b2dc8e6bb64be633250bad1ae3d9ef",
              "lessThan": "bd554ed4fdc3d38404a1c43d428432577573e809",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f9929ef6a2a55f03aac61248c6a3a987b8546f2a",
              "lessThan": "30fd6521b2fbd9b767e438e31945e5ea3e3a2fba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f9929ef6a2a55f03aac61248c6a3a987b8546f2a",
              "lessThan": "7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f9929ef6a2a55f03aac61248c6a3a987b8546f2a",
              "lessThan": "ecd7e1c562cb08e41957fcd4b0e404de5ab38e20",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f9929ef6a2a55f03aac61248c6a3a987b8546f2a",
              "lessThan": "4b081ce0d830b684fdf967abc3696d1261387254",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/server/auth.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.4.15",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.*"
            },
            {
              "status": "unaffected",
              "version": "6.5.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.5.*"
            },
            {
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/server/auth.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-02-21T08:15:45.203",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/30fd6521b2fbd9b767e438e31945e5ea3e3a2fba",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4b081ce0d830b684fdf967abc3696d1261387254",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bd554ed4fdc3d38404a1c43d428432577573e809",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ecd7e1c562cb08e41957fcd4b0e404de5ab38e20",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/30fd6521b2fbd9b767e438e31945e5ea3e3a2fba",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/4b081ce0d830b684fdf967abc3696d1261387254",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/bd554ed4fdc3d38404a1c43d428432577573e809",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/ecd7e1c562cb08e41957fcd4b0e404de5ab38e20",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()\n\nIf authblob->SessionKey.Length is bigger than session key\nsize(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes.\ncifs_arc4_crypt copy to session key array from SessionKey from client."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ksmbd: corrige el desbordamiento de slub en ksmbd_decode_ntlmssp_auth_blob() Si authblob->SessionKey.Length es mayor que el tamaño de la clave de sesión (CIFS_KEY_SIZE), puede ocurrir un desbordamiento de slub en los códigos de intercambio de claves. cifs_arc4_crypt copia a la matriz de claves de sesión desde SessionKey del cliente."
    }
  ],
  "lastModified": "2026-08-15T13:17:40.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "169F25B6-7A66-437D-B095-420A0C9D2628",
              "versionEndExcluding": "6.1.52",
              "versionStartIncluding": "5.17.0"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB08B8F4-BEEF-473F-8A44-8C0DC24B919C",
              "versionEndExcluding": "6.4.15",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496F2478-0324-4792-B3ED-95D8884323A4",
              "versionEndExcluding": "6.5.2",
              "versionStartIncluding": "6.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}