PT-2023-2823 · Linux+5 · Linux Kernel+5

Quentin Minster + 1 · Publicado 2023-04-27 · Atualizado 2024-08-21 · CVE-2023-32254

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel ksmbd (affected versions not specified)

Description A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of "SMB2 TREE DISCONNECT" commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this issue to execute code in the context of the kernel. The exploitation of this flaw may allow a remote attacker to impact the integrity, availability, and confidentiality of protected information and execute arbitrary code using the "SMB2 TREE DISCONNECT" command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2023-4482

ALT-PU-2023-4663

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-27402

AZL-27634

BDU:2023-02749

CVE-2023-32254

DSA-5448-1

OESA-2023-1781

OESA-2023-1782

OESA-2023-1783

USN-6173-1

USN-6283-1

USN-6725-1

USN-6725-2

ZDI-23-702

Produtos afetados

Alt Linux

Astra Linux

Linux Kernel

Linuxmint

Red Os

Ubuntu

Referências · 114

• https://github.com/torvalds/linux/commit/30210947a343b6b3ca13adc9bfc88e1543e16dd5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-31083 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-52340 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-23-702 · Correção, Nota de Segurança
• https://ubuntu.com/security/CVE-2024-26591 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-52448 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-52449 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-yadra-os-05-09-23-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-32254 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-52463 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-52457 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-32254 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-52438 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-52443 · Aviso do Fabricante
• https://git.kernel.org/linus/30210947a343b6b3ca13adc9bfc88e1543e16dd5 · Nota