PT-2023-2823 · Linux+5 · Linux Kernel+5

Quentin Minster + 1 · Published 2023-04-27 · Updated 2024-08-21 · CVE-2023-32254

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel ksmbd (affected versions not specified)

Description A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of "SMB2 TREE DISCONNECT" commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this issue to execute code in the context of the kernel. The exploitation of this flaw may allow a remote attacker to impact the integrity, availability, and confidentiality of protected information and execute arbitrary code using the "SMB2 TREE DISCONNECT" command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2023-4482

ALT-PU-2023-4663

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-27402

AZL-27634

BDU:2023-02749

CVE-2023-32254

DSA-5448-1

OESA-2023-1781

OESA-2023-1782

OESA-2023-1783

USN-6173-1

USN-6283-1

USN-6725-1

USN-6725-2

ZDI-23-702

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Linuxmint

Red Os

Ubuntu

References · 114

• https://nvd.nist.gov/vuln/detail/CVE-2023-31083 · Security Note
• https://ubuntu.com/security/CVE-2023-52340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26591 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52448 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32254 · Security Note
• https://ubuntu.com/security/CVE-2023-52463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52438 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52443 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27634 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2898 · Security Note
• https://ubuntu.com/security/CVE-2023-52464 · Vendor Advisory