CVE-2023-32247

Deeper analysis

The vulnerability is a resource consumption flaw, tracked as CWE-401, in the Linux kernel's ksmbd component that implements an in-kernel SMB server. It occurs during handling of SMB2_SESSION_SETUP commands and allows uncontrolled allocation that can exhaust system resources, producing a denial-of-service condition. The affected software is the Linux kernel containing the ksmbd module; the issue carries a CVSS 3.1 score of 7.5.

An unauthenticated network attacker can send a series of specially crafted SMB2_SESSION_SETUP requests to trigger the flaw. Because the attack requires no credentials or user interaction and can be launched remotely, successful exploitation results in a high-impact availability loss on the target system while leaving confidentiality and integrity unaffected.

The EPSS score for this CVE started low after the July 2023 disclosure, rose materially to a peak of 0.0914 on 2025-01-22, and has since fallen to 0.0009, indicating a period of increased exploitation interest well after public release. Red Hat, NetApp, and Zero Day Initiative have published advisories referencing the issue for tracking and mitigation.