CVE-2023-32255

What it actually does

Memory leak in ksmbd triggered by session setup requests containing unknown NTLMSSP message types, allowing repeated allocation without corresponding frees and eventual resource exhaustion.

Why it matters to the business

Systems providing SMB file sharing can experience denial-of-service conditions, interrupting access to shared resources and requiring restarts to recover memory.

How an attack unfolds

An attacker repeatedly sends specially crafted SMB session setup requests with invalid NTLMSSP message types to a vulnerable ksmbd instance, causing incremental memory consumption until the system becomes unresponsive.

How to fix it

Update the Linux kernel to a version containing commit 6d7cb549c2ca20e1f07593f15e936fd54b763028 or later; rebuild and deploy the fixed kernel image across all affected hosts.

How to confirm the fix worked

Confirm the running kernel contains commit 6d7cb549c2ca20e1f07593f15e936fd54b763028 via git describe or uname output; perform controlled SMB session-setup tests and verify no memory growth occurs.

Typical attack path

1. Locate publicly reachable Linux systems exposing SMB ports with ksmbd enabled
2. Craft and transmit session setup packets containing unknown NTLMSSP message types
3. Repeat the requests at sufficient volume to trigger sustained memory leakage
4. Monitor for service degradation or kernel memory pressure indicators

How to detect it

Review SMB network logs for repeated session-setup requests with non-standard NTLMSSP message types; correlate with ksmbd process memory growth or out-of-memory kernel messages.

What your security team should do

• Prioritize kernel upgrades on all systems exposing ksmbd to the network
• Restrict SMB access to trusted networks or require authentication where feasible
• Monitor memory usage of ksmbd processes for anomalous growth patterns
• Apply vendor-supplied kernel updates within standard change windows