CVE-2023-39176

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
———
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Nov 18, 2024
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-391797.5A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation CVE-2023-391807.5A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after itsCVE-2023-391817.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected application contains an out of boundCVE-2023-391827.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391837.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391847.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391857.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391867.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391877.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391887.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of boundCVE-2023-391896.0A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlleCVE-2023-391918.2An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation o
CVE-2023-39176: High severity, CVSS 7.5 | Vulnix