CVE-2023-32247 : A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

Published 2023-07-24 16:15:11

Updated 2024-08-27 19:37:31

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-32247

Linux » Linux Kernel
Versions from including (>=) 6.3 and before (<) 6.3.2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.15 and before (<) 5.15.145
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.16 and before (<) 6.1.29
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 6.2 and before (<) 6.2.16
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Netapp » H300s » Version: N/A
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
Matching versions
Netapp » H500s » Version: N/A
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
Matching versions
Netapp » H700s » Version: N/A
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
Matching versions
Netapp » H410s » Version: N/A
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-32247

EPSS FAQ

9.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32247

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Red Hat, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-32247

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)

References for CVE-2023-32247

https://bugzilla.redhat.com/show_bug.cgi?id=2219803

2219803 – (CVE-2023-32247, ZDI-23-695, ZDI-CAN-20478) CVE-2023-32247 kernel: ksmbd: session setup memory exhaustion denial-of-service vulnerability
Issue Tracking;Patch;Third Party Advisory
https://security.netapp.com/advisory/ntap-20230915-0011/

July 2023 Linux Kernel 6.3.9 Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://www.zerodayinitiative.com/advisories/ZDI-CAN-20478/

ZDI-23-695 | Zero Day Initiative
Patch;Third Party Advisory;VDB Entry
https://access.redhat.com/security/cve/CVE-2023-32247

CVE-2023-32247- Red Hat Customer Portal
Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-32247

Products affected by CVE-2023-32247

Exploit prediction scoring system (EPSS) score for CVE-2023-32247

CVSS scores for CVE-2023-32247

CWE ids for CVE-2023-32247

References for CVE-2023-32247