CVE-2023-32252

What it actually does

The vulnerability is an invalid pointer dereference in ksmbd's SMB2_LOGOFF command handler that occurs because a pointer is accessed without prior validation, resulting in a kernel crash.

Why it matters to the business

Remote unauthenticated attackers can trigger denial of service against systems exposing the in-kernel SMB server, interrupting network file sharing and potentially requiring manual reboots with no ransomware or data theft observed.

How an attack unfolds

An attacker establishes an SMB connection to the target and transmits a crafted SMB2_LOGOFF request that reaches the unvalidated pointer access path, causing an immediate kernel oops or panic.

How to fix it

Update the Linux kernel to a version containing commit 5729a900a07b7f166b94577c543d44c4c42e5ec3 or later; disable ksmbd if the service is not required.

How to confirm the fix worked

Confirm the running kernel source tree contains commit 5729a900a07b7f166b94577c543d44c4c42e5ec3; test connectivity with SMB2_LOGOFF packets in an isolated environment to verify absence of crash.

Typical attack path

1. Establish unauthenticated SMB connection to ksmbd
2. Send specially crafted SMB2_LOGOFF command
3. Trigger invalid pointer access leading to kernel crash

How to detect it

Review kernel logs and dmesg for oops or panic entries containing ksmbd and references to SMB2_LOGOFF or pointer validation failures.

• ksmbd.*LOGOFF
• kernel:.*invalid.*pointer.*ksmbd
• BUG: unable to handle kernel NULL pointer dereference.*ksmbd

What your security team should do

• Apply the referenced kernel commit on all systems running ksmbd
• Disable the ksmbd module via kernel configuration if SMB server functionality is unnecessary
• Add kernel crash monitoring for ksmbd-related oops entries