Linux Kernel up to 6.3 ksmbd race condition

Summaryinfo

A vulnerability described as very critical has been identified in Linux Kernel up to 6.3. This issue affects some unknown processing of the component ksmbd. The manipulation results in race condition. This vulnerability is reported as CVE-2023-32254. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.3 (Operating System). Affected is an unknown code block of the component ksmbd. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

The weakness was disclosed 05/18/2023. The advisory is shared for download at zerodayinitiative.com. This vulnerability is traded as CVE-2023-32254 since 05/05/2023. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 08/21/2024).

As 0-day the estimated underground price was around $25k-$100k.

Upgrading to version 6.4-rc1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 30210947a343b6b3ca13adc9bfc88e1543e16dd5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0
• 6.1
• 6.2
• 6.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion