CVE-2023-32250
Session race condition remote code execution vulnerability
At a glance
- Severity
- CRITICAL 9.0
- EPSS
- EPSS 2.61 % · percentile 85 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H | redhat |
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2023-36507
- GCVE · GCVE-0-2023-32250
CERT-FR advisories
- CERTFR-2024-AVI-0163 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0143 — Multiples vulnérabilités dans le noyau Linux Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0114 — Multiples vulnérabilités dans le noyau Linux Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0751 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0726 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0515 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0488 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15 < 5.15.145cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.29cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.2.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.3 < 6.3.2cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_storage_nodes:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
Affected products
References
- https://access.redhat.com/security/cve/CVE-2023-32250
- https://bugzilla.redhat.com/show_bug.cgi?id=2208849
- https://www.zerodayinitiative.com/advisories/ZDI-23-698/
- https://security.netapp.com/advisory/ntap-20230824-0004/
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |