CVE-2023-52440 PoC — ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

Source

https://github.com/BitsByWill/ksmbd-n-day

Associated Vulnerability

Title: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() (CVE-2023-52440)
Description:In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

Description

Authenticated 0-click RCE against Linux 6.1.45 for CVE-2023-52440 and CVE-2023-4130

Readme

# README

This repo accompanies my research article [Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days](https://www.willsroot.io/2025/09/ksmbd-0-click.html), in which I develop a POC for n-days from 2023: CVE-2023-52440 and CVE-2023-4130.

I provide the kernel .config, a kernel run script, an image build script, and the POC.

The image creation script comes from [Syzkaller](https://github.com/google/syzkaller/blob/master/tools/create-image.sh). The diff for [impacket](https://github.com/fortra/impacket/tree/master) comes from commit 7561038277f4b08a16f37aac886cfe0193e75434.

This is solely for research purposes only. In fact, this POC was designed on an extremely out of date LTS kernel (6.1.45), on a custom kernel config, and on a custom build toolchain.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →