CVE-2023-32257

Deeper analysis

A flaw exists in the Linux kernel's ksmbd component, the in-kernel SMB server. The vulnerability occurs during handling of SMB2_SESSION_SETUP and SMB2_LOGOFF commands and stems from missing synchronization primitives when operating on shared objects, producing a race condition (CWE-362, CWE-667). Successful exploitation grants an attacker the ability to run arbitrary code inside the kernel. The issue carries a CVSS 3.1 base score of 8.1 with network attack vector and no required credentials or user interaction.

An unauthenticated remote attacker can trigger the race by sending a crafted sequence of session-setup and logoff requests. Because the flaw resides in kernel memory management, compromise yields full control over the target system, including the ability to read, modify, or destroy arbitrary data and to install persistent root-level malware.

Public advisories from Red Hat, NetApp, and the Zero Day Initiative reference upstream kernel patches that add the missing locking around the affected session objects; administrators are advised to apply the relevant updates or to disable ksmbd if it is not required.

EPSS for the CVE rose from a low baseline to a peak of 0.0975 on 2025-01-22 before receding, indicating a clear post-disclosure increase in observed exploitation interest that warrants renewed monitoring.