PT-2023-2814 · Linux+5 · Linux Kernel+5

Quentin Minster + 1 · Published 2023-05-01 · Updated 2024-08-21 · CVE-2023-32250

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel's ksmbd (affected versions not specified)

Description The issue is related to errors in synchronization when using a shared resource in the Linux kernel's ksmbd module, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2 SESSION SETUP commands. The problem results from the lack of proper locking when performing operations on an object. An attacker can leverage this to execute code in the context of the kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2023-4482

ALT-PU-2023-4663

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-27401

AZL-27641

BDU:2023-02740

CVE-2023-32250

DSA-5448-1

USN-6173-1

USN-6338-1

USN-6338-2

USN-6344-1

USN-6626-1

USN-6626-2

USN-6626-3

USN-6628-1

USN-6628-2

ZDI-23-698

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 78

• https://bugzilla.redhat.com/show_bug.cgi?id=2208849 · Patch
• https://ubuntu.com/security/notices/USN-6338-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-698 · Security Note
• https://osv.dev/vulnerability/AZL-27641 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2898 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46813 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6338-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02740 · Security Note
• https://osv.dev/vulnerability/USN-6626-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6040 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6628-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6344-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6622 · Vendor Advisory