A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results     from the lack of proper validation of user-supplied data, which can result in a read past the end of an     allocated buffer. An attacker can leverage this to disclose sensitive information on affected     installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE. (CVE-2023-4458)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
332368	Photon OS 5.0: Linux PHSA-2025-5.0-91-0610	Nessus	PhotonOS Local Security Checks	Local	high
261144	Photon OS 5.0: Linux PHSA-2025-5.0-0610	Nessus	PhotonOS Local Security Checks	Local	high
227040	Linux Distros Unpatched Vulnerability : CVE-2023-4458	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2023-4458

high

Tenable Plugins

high

high

high