CVE-2023-32248

Name	CVE-2023-32248
Description	A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bookworm	6.1.176-1	fixed
	bookworm (security)	6.1.180-1	fixed
	trixie	6.12.94-1	fixed
	trixie (security)	6.12.107-1	fixed
	forky	7.1.12-1	fixed
	sid	7.1.13-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
linux	source	buster	(not affected)
linux	source	bullseye	(not affected)
linux	source	bookworm	6.1.37-1
linux	source	(unstable)	6.3.7-1

Notes

[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
https://www.zerodayinitiative.com/advisories/ZDI-CAN-20479/
https://git.kernel.org/linus/3ac00a2ab69b34189942afa9e862d5170cdcb018 (6.4-rc1)