Description
A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms.
Problem types
Improper Restriction of Excessive Authentication Attempts
Product status
Any version before 5.15.145
6.0.0 (semvar) before 6.0.*
6.1.0 (semvar) before 6.1.29
6.2.0 (semvar) before 6.2.16
6.3.0 (semvar) before 6.3.2
Timeline
| 2025-07-31: | Reported to Red Hat. |
| 2023-05-17: | Made public. |
References
access.redhat.com/security/cve/CVE-2023-32251
bugzilla.redhat.com/show_bug.cgi?id=2385852 (RHBZ#2385852)
git.kernel.org/...d=b096d97f47326b1e2dbdef1c91fab69ffda54d17
www.zerodayinitiative.com/advisories/ZDI-23-699/