CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-32248 – Tree connection null pointer dereference denial-of-service vulnerability
https://notcve.org/view.php?id=CVE-2023-32248
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Se ha encontrado un fallo en el ksmbd del kernel de Linux, un servidor SMB de alto rendimiento integrado en el kernel. • https://access.redhat.com/security/cve/CVE-2023-32248 https://bugzilla.redhat.com/show_bug.cgi?id=2219818 https://security.netapp.com/advisory/ntap-20230915-0006 https://www.zerodayinitiative.com/advisories/ZDI-CAN-20479 • CWE-476: NULL Pointer Dereference •
CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0CVE-2023-32250 – Session race condition remote code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-32250
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. • https://access.redhat.com/security/cve/CVE-2023-32250 https://bugzilla.redhat.com/show_bug.cgi?id=2208849 https://security.netapp.com/advisory/ntap-20230824-0004 https://www.zerodayinitiative.com/advisories/ZDI-23-698 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2023-32257 – Session race condition remote code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-32257
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Se encontró una falla en el ksmbd del kernel de Linux, un servidor SMB de alto rendimiento en el kernel. • https://access.redhat.com/security/cve/CVE-2023-32257 https://bugzilla.redhat.com/show_bug.cgi?id=2219806 https://security.netapp.com/advisory/ntap-20230915-0011 https://www.zerodayinitiative.com/advisories/ZDI-CAN-20596 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-667: Improper Locking •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2023-2124 – kernel: OOB access in the Linux kernel's XFS subsystem
https://notcve.org/view.php?id=CVE-2023-2124
An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/xfs/xfs_buf_item_recover.c?h=v6.4-rc1&id=22ed903eee23a5b174e240f1cdfa9acf393a5210 https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html https://security.netapp.com/advisory/ntap-20230622-0010 https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e https://www.debian.org/security/2023/dsa-5448 https://www.debian.org/security/2023/dsa-5480 https://access.redhat.com/security/cve/CVE-2023-2124 https&# • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-1096
https://notcve.org/view.php?id=CVE-2023-1096
SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user. • https://security.netapp.com/advisory/ntap-20230511-0011 •