CVE-2023-32255: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel's ksmbd component (CVE-2023-32255) was discovered that allows remote attackers to create a denial-of-service condition. The vulnerability affects systems with ksmbd enabled and does not require authentication to exploit. The issue was discovered in April 2023 and publicly disclosed in May 2023 (ZDI Advisory).

The vulnerability exists within the handling of SMB2_SESSION_SETUP commands in the Linux kernel's ksmbd component. The specific flaw results from the lack of memory release after its effective lifetime when processing session setup requests with unknown NTLMSSP message types. The vulnerability has been assigned a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (ZDI Advisory).

An attacker can leverage this vulnerability to create a denial-of-service condition on the system by causing memory leaks through malicious session setup requests. This can lead to resource exhaustion on affected systems (ZDI Advisory, Red Hat Bugzilla).

Linux has issued updates to correct this vulnerability. Multiple Linux distributions have released patches, including Ubuntu which has fixed the issue in various kernel versions such as 5.15.0-79.86~20.04.2 for Ubuntu 20.04 LTS (Ubuntu Security).