PT-2023-2814 · Linux+5 · Linux Kernel+5

Quentin Minster + 1 · Publicado 2023-05-01 · Atualizado 2024-08-21 · CVE-2023-32250

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel's ksmbd (affected versions not specified)

Description The issue is related to errors in synchronization when using a shared resource in the Linux kernel's ksmbd module, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2 SESSION SETUP commands. The problem results from the lack of proper locking when performing operations on an object. An attacker can leverage this to execute code in the context of the kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2023-4482

ALT-PU-2023-4663

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-27401

AZL-27641

BDU:2023-02740

CVE-2023-32250

DSA-5448-1

USN-6173-1

USN-6338-1

USN-6338-2

USN-6344-1

USN-6626-1

USN-6626-2

USN-6626-3

USN-6628-1

USN-6628-2

ZDI-23-698

Produtos afetados

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

Referências · 78

• https://github.com/torvalds/linux/commit/f5c779b7ddbda30866cf2a27c63e34158f858c73 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2208849 · Correção
• https://t.me/cvenotify/91614 · Publicação no Telegram
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-yadra-os-05-09-23-1 · Nota
• https://ubuntu.com/security/notices/USN-6338-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-32250 · Nota
• https://zerodayinitiative.com/advisories/ZDI-23-698 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-27641 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-32254 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-2898 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-46813 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6338-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02740 · Nota de Segurança
• https://osv.dev/vulnerability/USN-6626-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-32250 · Aviso do Fabricante