CVE-2023-32253

What it actually does

A deadlock condition in the ksmbd component of the Linux kernel triggered by multiple concurrent session setup requests, resulting in denial of service.

Why it matters to the business

Can cause service disruption and unavailability of affected systems, leading to operational downtime until the system is restarted or the flaw is mitigated, with low but present exploitation probability.

How an attack unfolds

An attacker identifies a target exposing ksmbd and sends multiple concurrent session setup requests, inducing a deadlock that results in denial of service without requiring authentication or special privileges.

How to fix it

Upgrade conjur-cli (Chainguard) to 8.1.2-r1 or later and conjur-cli (Wolfi) to 8.1.2-r1 or later; apply corresponding Linux kernel patches addressing the ksmbd deadlock.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases and test that concurrent session setup requests no longer produce a deadlock condition.

Typical attack path

1. Scan for systems exposing SMB services backed by ksmbd
2. Send multiple concurrent unauthenticated session setup requests
3. Trigger kernel deadlock to cause service unavailability

How to detect it

Review kernel and SMB service logs for repeated session setup attempts coinciding with deadlock or hang conditions; correlate with system availability alerts.

What your security team should do

• Prioritize upgrade of affected packages to the listed fixed versions
• Restrict network exposure of SMB services where feasible
• Monitor system logs for deadlock indicators during the update window