Junglewise Threat Intelligence

CVE-2023-32251: Linux Kernel ksmbd brute force delay bypass via asynchronous requests

CVE-2023-32251 · Severity: low · CVSS 3.7 · Published 2025-07-31

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's ksmbd component, which provides file-sharing services, allows attackers to bypass a security delay intended to prevent password guessing. Normally, the system enforces a 5-second wait after a failed login attempt to slow down automated attacks; however, this protection can be ignored by using specific types of network requests. This could allow an attacker to more quickly attempt to guess user credentials and gain unauthorized access to shared files.

Technical details

A vulnerability exists in the ksmbd (SMB/CIFS server) component of the Linux kernel due to improper restriction of excessive authentication attempts (CWE-307). The server implements a 5-second sleep (ssleep(5)) during session setup failures to mitigate brute-force attacks; however, this delay can be bypassed by sending asynchronous requests. An unauthenticated remote attacker can exploit this flaw to perform high-speed dictionary attacks against user credentials. The fix involves blocking all requests on the current connection by setting the connection to require reconnection and renegotiation when a delay is triggered. Patches were merged into the mainline kernel and backported to stable branches including 5.15.145, 6.1.29, 6.2.16, and 6.3.2.

Affected products

  • Linux Linux Kernel 5.15.x before 5.15.145, 6.1.x before 6.1.29, 6.2.x before 6.2.16, 6.3.x before 6.3.2

Timeline

  • 2023-04-27: disclosed: Vulnerability reported to vendor via ZDI
  • 2023-05-03: patched: Fix committed to Linux kernel source tree
  • 2023-05-17: advisory: ZDI advisory published
  • 2025-07-31: advisory: NVD publication date

References