CVE-2023-32247

What it actually does

The flaw allows unbounded resource consumption when processing SMB2_SESSION_SETUP commands in the ksmbd in-kernel SMB server, leading to denial of service through exhaustion of kernel resources.

Why it matters to the business

Systems running affected kernel versions may become unavailable for file sharing and other network services, causing operational downtime; the issue has been public for over three years with low exploitation probability and no known ransomware use.

How an attack unfolds

An attacker establishes an SMB connection to a vulnerable Linux system and repeatedly sends specially crafted SMB2_SESSION_SETUP commands that trigger excessive resource allocation without proper limits, eventually causing the kernel to become unresponsive.

How to fix it

Upgrade the Linux kernel to a version containing commit 5729a900a07b7f166b94577c543d44c4c42e5ec3 or later; disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Verify the running kernel includes commit 5729a900a07b7f166b94577c543d44c4c42e5ec3 by checking kernel source or package version; test that excessive SMB2_SESSION_SETUP traffic no longer causes resource exhaustion.

Typical attack path

1. Discover exposed SMB ports on Linux systems running ksmbd
2. Initiate unauthenticated or low-privilege SMB sessions
3. Send a high volume of SMB2_SESSION_SETUP requests designed to consume kernel resources
4. Continue until the target system experiences resource exhaustion and becomes unresponsive

How to detect it

Review kernel and SMB service logs for repeated SMB2_SESSION_SETUP processing events, spikes in resource usage correlated with SMB traffic, and system crashes or hangs following SMB session activity.

What your security team should do

• Apply the referenced kernel commit or update to a patched distribution kernel as soon as possible
• Restrict SMB access to trusted networks and disable ksmbd where unnecessary
• Monitor for high volumes of SMB session setup traffic from untrusted sources
• Include the fix in standard kernel update and vulnerability management processes