Remote code execution in Linux kernel ksmbd

Published: 2023-06-19

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-32250 CVE-2023-32254
CWE-ID	CWE-362
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Linux kernel Operating systems & Components / Operating system
Vendor

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Race condition

EUVDB-ID: #VU77497

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-32250

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition within the fs/ksmbd/connection.c in ksmbd in Linux kernel when processing SMB2_SESSION_SETUP commands. A remote attacker can exploit the race by sending concurrent session setup and logoff request and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: before 6.4 rc1

External links

http://www.zerodayinitiative.com/advisories/ZDI-23-698/
http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5c779b7ddbda30866cf2a27c63e34158f858c73
http://bugzilla.redhat.com/show_bug.cgi?id=2208849

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Race condition

EUVDB-ID: #VU77498