High severity · published Jul 10, 2023
CVE-2023-32250
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server
8.1
CVSS
2.6%
EPSS
No
On KEV
Description
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.15 before 5.15.145; 5.16 before 6.1.29; 6.2 before 6.2.16; 6.3 before 6.3.2 · source: NVD
H3
H300s · Netapp
All versions, or not specified · source: NVD
H4
H410s · Netapp
All versions, or not specified · source: NVD
H5
H500s · Netapp
All versions, or not specified · source: NVD
H7
H700s · Netapp
All versions, or not specified · source: NVD
HC
Hci · Netapp
All versions, or not specified · source: NVD
HS
Hci Storage Nodes · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32250
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-32250
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2208849
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230824-0004/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-698/
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability