CVE-2023-32250
Assigner: redhat
Published: 2023-07-10T15:09:37.474Z
State: PUBLISHED
title: Session race condition remote code execution vulnerability
metrics: other: content: value: Important
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
descriptions: value: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
affected: product: kernel
vendor: n/a
versions: version: 6.4-rc1
status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:9
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:9
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: kernel
defaultStatus: unaffected
datePublic: 2023-05-17T00:00:00Z
problemTypes: descriptions: cweId: CWE-362
description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
type: CWE
x_redhatCweChain: CWE-667->CWE-362: Improper Locking leads to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
timeline: time: 2023-05-21T00:00:00Z
value: Reported to Red Hat.
time: 2023-05-17T00:00:00Z
value: Made public.