CVE-2023-32250

CRITICAL

Linux Kernel >=5.15 <5.15.145 - Race Condition in ksmbd SMB2_SESSION_SETUP Processing

Title source: llm
STIX 2.1

Description

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

References (4)

Core 4
Core References
Third Party Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2023-32250
Issue Tracking, Patch, Third Party Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2208849

Scores

CVSS v3 9.0
EPSS 0.0011
EPSS Percentile 29.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-362
Status published
Products (7)
linux/linux_kernel 5.15 - 5.15.145
netapp/h300s
netapp/h410s
netapp/h500s
netapp/h700s
netapp/hci
netapp/hci_storage_nodes
Published Jul 10, 2023
Tracked Since Feb 18, 2026