CVE-2023-54250 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: avoid out of bounds access in decode_preauth_ctxt()
Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient.
Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54250 resides within the Linux kernel's ksmbd implementation, specifically in the decode_preauth_ctxt() function that processes SMB2 negotiation contexts. This flaw represents a classic out-of-bounds memory access vulnerability that could potentially allow malicious actors to exploit the SMB server implementation. The issue manifests when processing pre-authentication contexts within SMB2 negotiation packets, where the kernel fails to properly validate memory boundaries before accessing structured data elements. The vulnerability is particularly concerning as it affects the core SMB protocol handling mechanism that governs authentication and session establishment in network file sharing environments.
The technical root cause stems from insufficient boundary checking within the deassemble_neg_contexts() function which processes SMB2 negotiation contexts. While this function validates that the eight-byte SMB2_NEG_CONTEXT header plus the client-controlled DataLength field remains within packet boundaries, this validation proves inadequate for preventing out-of-bounds access. The flaw occurs because the implementation does not verify that the pneg_ctxt->HashAlgorithms address falls within the legitimate SMB request boundary, allowing potential attackers to craft malicious packets that could cause memory corruption. This type of vulnerability aligns with CWE-129, which specifically addresses insufficient validation of length of input buffers, and represents a common pattern in network protocol implementations where header validation does not extend to validating the complete data structures that follow.
The operational impact of this vulnerability extends beyond simple memory corruption, as it could enable attackers to manipulate the SMB server's memory layout and potentially achieve arbitrary code execution or denial of service conditions. When an attacker sends a specially crafted SMB2 negotiation packet with malformed pre-authentication context data, the kernel's insufficient boundary checking allows access to memory locations that should remain protected. This vulnerability affects systems running Linux kernels with ksmbd SMB server functionality, particularly those implementing SMB3.1.1 protocol features including pre-authentication contexts and salt-based authentication mechanisms. The attack surface is significant in enterprise environments where SMB file sharing is prevalent, as it could be exploited by remote unauthenticated attackers to compromise file servers or network infrastructure. According to ATT&CK framework, this vulnerability maps to T1190 - Exploit Public-Facing Application, as it affects a publicly accessible network service, and T1210 - Exploitation of Remote Services, since it targets a remote SMB server implementation.
Mitigation strategies should focus on applying the kernel patch that implements proper boundary validation for pre-authentication context data structures. The fix requires checking that the accessed address sits within the SMB request boundary before allowing access to pneg_ctxt->HashAlgorithms, rather than relying solely on the initial header and DataLength validation. Organizations should prioritize updating their Linux kernel versions to include the patched ksmbd implementation, particularly in environments where SMB servers are exposed to untrusted networks. Additionally, network segmentation and firewall rules should be implemented to restrict SMB traffic to trusted internal networks only. Monitoring for suspicious SMB2 negotiation patterns and implementing intrusion detection systems can help detect exploitation attempts. The vulnerability demonstrates the importance of comprehensive input validation in network protocol implementations and highlights the need for thorough boundary checking when processing variable-length data structures within network packets.