CVE-2023-32252
Published: 24 July 2023
Summary
CVE-2023-32252 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis
A flaw exists in the Linux kernel's ksmbd, the high-performance in-kernel SMB server, specifically in its handling of SMB2_LOGOFF commands. The root cause is missing validation of a pointer before it is dereferenced, classified as CWE-476. The resulting denial-of-service condition carries a CVSS 3.1 base score of 7.5 with network attack vector, no required privileges or user interaction, and high availability impact.
An unauthenticated remote attacker can send crafted SMB2_LOGOFF requests to a vulnerable ksmbd instance and trigger a kernel-level crash or service outage, achieving denial of service without any other system access.
The EPSS probability rose from a low baseline to a peak of 0.0660 on 2025-01-22 before receding to the current value of 0.0014, indicating a period of increased exploitation interest after public disclosure. Red Hat, NetApp, and Zero Day Initiative advisories reference the issue and point to corresponding kernel updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36509
Vulnerability details
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it.…
more
An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.