Junglewise Threat Intelligence

CVE-2023-32255: Linux Kernel memory leak in ksmbd session setup

CVE-2023-32255 · Severity: medium · CVSS 5.3 · Published 2025-08-02

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's ksmbd component, which provides file-sharing services over a network. An unauthenticated remote attacker can cause the system to leak memory by sending specially crafted requests. Over time, this can exhaust available system resources, leading to a denial-of-service condition where the server becomes unresponsive or crashes.

Technical details

A memory leak vulnerability (CWE-772) exists in the ksmbd component of the Linux kernel during the handling of SMB2_SESSION_SETUP commands. When a client sends a session setup request containing an unknown NTLMSSP message type, ksmbd may create a session that does not include a channel. Because the ksmbd_sessions_deregister() function fails to destroy sessions lacking an associated channel, the allocated memory is never released. An unauthenticated remote attacker can exploit this over a network to cause resource exhaustion and a denial-of-service. The issue has been patched in various stable kernel branches, including 5.15.111, 6.1.28, 6.2.15, and 6.3.2.

Affected products

  • Linux Linux Kernel 5.15.111, 6.1.28, 6.2.15, 6.3.2

Timeline

  • 2023-04-27: disclosed: Vulnerability reported to vendor via ZDI
  • 2023-05-03: patched: Fix committed to Linux kernel source tree
  • 2023-05-17: advisory: ZDI advisory published
  • 2025-08-02: advisory: NVD advisory published

References

Related threats