Remote code execution in Linux Kernel ksmbd

Published: 2023-09-06

Risk	High
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2023-32257
CWE-ID	CWE-362
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Linux kernel Operating systems & Components / Operating system
Vendor	Linux Foundation

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Race condition

EUVDB-ID: #VU80494

Risk: High

CVSSv3.1:

CVE-ID: CVE-2023-32257

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition when handling SMB2_SESSION_SETUP and SMB2_LOGOFF commands. A remote attacker can send specially crafted data to the affected server, trigger a race condition and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

Fixed software versions

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

http://bugzilla.redhat.com/show_bug.cgi?id=2219806
http://github.com/torvalds/linux/commit/f5c779b7ddbda30866cf2a27c63e34158f858c73
http://www.zerodayinitiative.com/advisories/ZDI-23-705/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?