CVE-2023-54203: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2023-54203 is a slab-out-of-bounds read vulnerability in the Linux kernel's ksmbd (kernel SMB server) subsystem, specifically in the init_smb2_rsp_hdr function. The flaw is triggered when an SMB1 (CIFS dialect vers=1.0) mount attempt fails and the SMB2 server operation handler incorrectly processes the SMB1 negotiate request, causing a KASAN-detected out-of-bounds memory read. Affected versions are those of the Linux kernel prior to the backported fixes across stable branches. The vulnerability carries an estimated CVSS severity of Medium and an EPSS score of approximately 0.025% (Feedly, VulDB).

The root cause is an improper handling of SMB protocol version negotiation in the ksmbd module (CWE-125: Out-of-bounds Read). When a client connects using SMB1 (vers=1.0), the ksmbd server incorrectly routes the negotiate request through SMB2 server operations — specifically init_smb2_rsp_hdr — which reads 16 bytes from an address that falls outside the allocated slab buffer for the smaller SMB1 negotiate packet (56 bytes). The fix adds dedicated SMB1 server operation handlers (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) so that SMB1 negotiate requests are handled independently and do not fall through to SMB2 logic. Patches are available in the Linux stable kernel tree (Linux Kernel Git, Linux Kernel Git).

Successful exploitation of this vulnerability can cause a kernel crash (denial of service) on systems running ksmbd when an SMB1 client attempts to connect. The out-of-bounds read may also expose sensitive kernel memory contents, posing a limited confidentiality risk. The primary impact is availability — a kernel panic or system instability — affecting any service hosted on the vulnerable system (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2023-54203. The EPSS score is approximately 0.025%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to be able to send an SMB1 negotiate request to a system running ksmbd, which is typically an internal network service (Feedly, VulDB).

Apply the upstream Linux kernel patches that introduce SMB1-specific server operation handlers in ksmbd. The fixes are available in the Linux stable kernel tree across multiple stable branches (commits 99a51c673b1d, 921536046bd1, a8334a0c535d, dc8289f912387). As a workaround, administrators can disable ksmbd or block SMB1 (port 445) connections from untrusted clients at the network perimeter. Upgrading to a patched kernel version is the recommended long-term remediation (Linux Kernel Git, Tenable).