CVE-2023-6606 Overview
CVE-2023-6606 is an out-of-bounds read vulnerability in the smbCalcSize function located in fs/smb/client/netmisc.c within the Linux Kernel SMB client. A local attacker with low privileges can trigger the flaw to crash the system or leak internal kernel memory contents. The vulnerability affects multiple Linux Kernel versions and is tracked under [CWE-125: Out-of-bounds Read]. Red Hat Enterprise Linux 8 and 9, along with several Extended Update Support (EUS) and Advanced Update Support (AUS) variants, are confirmed affected.
Critical Impact
A local, authenticated user can crash the kernel (denial of service) or read sensitive kernel memory, potentially exposing credentials, keys, or other internal state.
Affected Products
- Linux Kernel (multiple versions including 6.4 and 6.7 release candidates)
- Red Hat Enterprise Linux 8.0 and 9.0
- Red Hat Enterprise Linux EUS 9.2, 9.4 and Server AUS 9.2, 9.4 (including Power Little Endian for SAP Solutions)
Discovery Timeline
- 2023-12-08 - CVE-2023-6606 published to the National Vulnerability Database
- 2024-01 - Debian LTS issues advisory for affected kernel packages
- 2024-02 through 2024-04 - Red Hat releases multiple security advisories (RHSA-2024:0723, RHSA-2024:0725, RHSA-2024:0881, RHSA-2024:0897, RHSA-2024:1188, RHSA-2024:1248, RHSA-2024:1404, RHSA-2024:2094)
- 2024-06 - Debian LTS issues follow-up advisory
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-6606
Vulnerability Analysis
The flaw resides in the smbCalcSize function within the SMB client code at fs/smb/client/netmisc.c. This function calculates the size of an incoming SMB protocol response by reading length fields from a server-supplied buffer. When the kernel processes a malformed or attacker-controlled SMB response, smbCalcSize reads past the bounds of the allocated buffer. The result is either a kernel oops causing a denial of service or disclosure of adjacent kernel memory.
Because the vulnerable code path is reached when mounting or interacting with an SMB share, a local user able to influence a mount target or interact with a malicious SMB server can trigger the condition. The issue is classified as [CWE-125: Out-of-bounds Read].
Root Cause
The root cause is missing or insufficient bounds validation on length fields contained in SMB response headers before they are used to compute buffer sizes. smbCalcSize trusts the protocol-supplied length, allowing access beyond the end of the allocated response buffer.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker who can connect the kernel SMB client to an attacker-controlled SMB server (for example, by mounting a share that points to a malicious endpoint) can serve crafted responses that cause smbCalcSize to read out of bounds. Successful exploitation impacts confidentiality through memory disclosure and availability through kernel crashes.
No public proof-of-concept exploit is currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the Kernel Bug Report #218218 and the Red Hat Bug Report #2253611.
Detection Methods for CVE-2023-6606
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing smbCalcSize, cifs, or smb modules in dmesg or /var/log/messages
- SMB client mount attempts to untrusted or unexpected remote endpoints
- Repeated cifs module load events on systems that do not normally use SMB
Detection Strategies
- Audit installed kernel versions against the fixed packages listed in the Red Hat advisories RHSA-2024:0723 through RHSA-2024:2094
- Monitor for kernel ring buffer entries containing BUG:, KASAN:, or general protection fault strings correlated with the cifs subsystem
- Inspect mount.cifs and equivalent command invocations through process auditing to identify suspicious mount targets
Monitoring Recommendations
- Enable Linux audit rules covering mount syscalls and cifs module loads to track SMB client activity
- Forward kernel logs to a centralized logging or SIEM platform to correlate crash events across hosts
- Track package inventory to identify hosts still running pre-patch kernel builds
How to Mitigate CVE-2023-6606
Immediate Actions Required
- Apply the kernel updates from your distribution vendor, prioritizing systems where the SMB client (cifs.ko) is loaded or used to mount shares
- Review Red Hat advisories and update affected Red Hat Enterprise Linux 8 and 9 systems using yum update kernel or dnf update kernel, then reboot
- Restrict which users can mount SMB shares and validate that mount targets resolve only to trusted servers
Patch Information
Red Hat has released kernel updates addressing CVE-2023-6606 through multiple advisories, including RHSA-2024:0723, RHSA-2024:0725, RHSA-2024:0881, RHSA-2024:0897, RHSA-2024:1188, RHSA-2024:1248, RHSA-2024:1404, and RHSA-2024:2094. Debian users should reference the Debian LTS Announcement January 2024 and the Debian LTS Announcement June 2024. Additional context is available in the CVE-2023-6606 Security Information page.
Workarounds
- Blacklist the cifs kernel module on systems that do not require SMB client functionality by adding blacklist cifs to /etc/modprobe.d/
- Remove or restrict permissions on mount.cifs to prevent non-privileged users from mounting SMB shares
- Block outbound SMB traffic (TCP 445) at host or network firewalls where SMB is not required
# Configuration example: disable the cifs module and block outbound SMB
echo "blacklist cifs" | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo rmmod cifs 2>/dev/null || true
sudo iptables -A OUTPUT -p tcp --dport 445 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
