CVE-2023-1194CWE-416

Use-after-free in parse_lease_state()

High · published November 3, 2023

CVSS v3.1
7.1
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01077 · 64.7th percentile
Weakness
CWE-416 · Use After Free
Published
2023-11-03T07:41Z
EPSS history
Timeline
  • 03 NOV 07:41Z
    Use-after-free in parse_lease_state()
    cvelistv5