CVE-2023-0210

What it actually does

This vulnerability is a remotely reachable memory-corruption flaw in the Linux kernel ksmbd SMB server’s NTLMv2 authentication handling. An unauthenticated attacker can send crafted SMB/NTLMSSP authentication traffic to a system running vulnerable ksmbd and trigger a kernel crash, causing denial of service. The CVSS vector indicates network access, low attack complexity, no privileges, and no user interaction, with impact limited to availability rather than confidentiality or integrity.

Why it matters to the business

Systems exposing the in-kernel ksmbd SMB service can be crashed remotely, interrupting file sharing, storage access, backups, application workflows, and dependent services. Because exploitation is available publicly and the EPSS score is high, internet-exposed or broadly reachable SMB services should be treated as urgent even though this is not currently listed in CISA KEV and is not known to be used in ransomware campaigns. The main operational risk is unplanned outages and repeated crashes until the host is patched, isolated, or ksmbd is disabled.

How an attack unfolds

An attacker first identifies a Linux host exposing SMB, typically TCP port 445, and determines or assumes it is using the kernel ksmbd server rather than a patched implementation. The attacker then initiates an SMB session and reaches NTLMv2 authentication. By sending malformed or specially sequenced NTLMSSP/NTLMv2 authentication data, the attacker triggers the vulnerable kernel code path in ksmbd. The flaw corrupts memory or dereferences invalid state during authentication handling, leading to a kernel panic, oops, or immediate system crash. Successful exploitation does not require valid credentials and primarily results in denial of service rather than code execution or data theft.

How to fix it

Upgrade the Linux kernel to a vendor-supported version that includes the upstream fix for ksmbd commit 797805d81baa814f76cf7bdab35f86408a79d707, or apply the relevant distribution backport containing that fix. Prefer distribution security updates over manually applying upstream commits unless maintaining a custom kernel. If immediate patching is not possible, disable ksmbd, unload or prevent loading the ksmbd kernel module where feasible, and restrict SMB exposure to trusted networks only. Block inbound TCP/445 and TCP/139 from untrusted networks, enforce host firewalls and network segmentation, and avoid exposing SMB services directly to the internet. Reboot into the patched kernel after installation, because kernel fixes are not effective until the running kernel is replaced.

How to confirm the fix worked

Confirm the running kernel includes the fix, not only that an updated package is installed. Validate with the distribution’s package advisory, kernel changelog, or source tree showing commit 797805d81baa814f76cf7bdab35f86408a79d707 or an equivalent backport. Check whether ksmbd is enabled or loaded using service and module status checks such as systemctl status ksmbd where applicable, lsmod for ksmbd, and SMB listener checks on TCP/445. Confirm external and internal scans no longer find vulnerable ksmbd exposure where it is not required. After remediation, perform a controlled SMB authentication test from an approved scanner or test client and verify the host remains stable with no new kernel oops, panic, or ksmbd errors in dmesg or journal logs.

Typical attack path

1. Scan for hosts exposing SMB on TCP port 445 or TCP port 139.
2. Identify Linux SMB services that may be running ksmbd.
3. Open an SMB session and negotiate authentication.
4. Send crafted NTLMSSP/NTLMv2 authentication messages that exercise the vulnerable ksmbd code path.
5. Trigger a kernel crash or panic, causing the host or service to become unavailable.
6. Repeat the request to cause recurring denial of service if the service remains exposed and unpatched.

How to detect it

Look for signs of attempted or successful denial-of-service exploitation rather than persistence or data theft. Primary sources are kernel logs, system journals, dmesg output, crash dumps, uptime/reboot records, SMB service logs, firewall logs, IDS/IPS telemetry, and NetFlow around TCP/445 and TCP/139. Investigate kernel oops, panic, watchdog, or unexpected reboot events that include ksmbd or occur immediately after inbound SMB negotiation or NTLMSSP authentication attempts. Correlate crashes with remote source IPs making repeated unauthenticated SMB connections, failed session setup attempts, malformed NTLMSSP traffic, or abnormal SMB authentication sequences. If crash dumping is enabled, inspect vmcore/kdump artifacts for stack traces referencing ksmbd authentication, NTLMSSP, or SMB session setup paths. Because the expected effect is an immediate OS crash, absence of application-level logs does not rule out exploitation; network telemetry just before reboot is often the best evidence.

• ksmbd
• NTLMSSP
• NTLMv2
• TCP/445
• TCP/139
• BUG: kernel NULL pointer dereference
• kernel panic
• Oops:
• general protection fault
• KASAN: use-after-free
• use-after-free
• ksmbd:
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• /proc/modules
• /var/crash
• vmcore
• kdump

What your security team should do

• Prioritize patching or mitigating any Linux hosts running ksmbd that expose SMB to untrusted networks, given the high EPSS score and available exploit material.
• Inventory SMB listeners on TCP/445 and TCP/139 and distinguish ksmbd-based Linux services from Samba or other SMB implementations.
• Apply vendor kernel updates containing the fix for commit 797805d81baa814f76cf7bdab35f86408a79d707, then reboot into the fixed kernel.
• Disable ksmbd where it is not explicitly required, especially on internet-facing systems.
• Restrict SMB access with firewalls, VPNs, allowlists, and segmentation so only trusted clients can reach the service.
• Monitor for unexplained Linux kernel crashes, reboots, and ksmbd authentication errors correlated with inbound SMB traffic.
• Review historical logs and network telemetry for SMB connection attempts immediately preceding crashes or panics.
• Add SIEM detections for kernel oops/panic messages involving ksmbd and for spikes in unauthenticated SMB negotiation/authentication attempts.