Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Feb 20, 2019 | Nov 28, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 28, 2018 |
| Debian | — | Upgrade samba | Nov 28, 2018 | Aug 14, 2018 |
| Freebsd | — | Upgrade samba46Upgrade samba48Upgrade samba47Upgrade samba49 | Nov 28, 2018 | Aug 14, 2018 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Mar 27, 2020 | Nov 28, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libsmbclientUpgrade samba-commonUpgrade samba-pidlUpgrade python3-samba-testUpgrade sambaUpgrade samba-libsUpgrade python3-sambaUpgrade ctdbUpgrade samba-winbindUpgrade samba-winbind-modulesUpgrade python2-sambaUpgrade ctdb-testsUpgrade samba-client-libsUpgrade samba-dc-libsUpgrade samba-krb5-printingUpgrade samba-clientUpgrade libwbclientUpgrade samba-test-libsUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade samba-common-libsUpgrade samba-testUpgrade samba-winbind-krb5-locator | Jul 26, 2019 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.9.6-11.4.11.0.1.1.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.9.6-11.4.11.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Nov 28, 2018 |
| Samba | — | Upgrade to Samba version 4.8.7Upgrade to Samba version 4.7.12Upgrade to Samba version 4.9.3 | Dec 4, 2018 | Nov 28, 2018 |
| Suse | — | Upgrade libsamba-policy0Upgrade libsmbldap2-32bitUpgrade samba-libsUpgrade libdcerpc-samr-develUpgrade libndr-krb5pac0-32bitUpgrade libsamba-policy-python3-develUpgrade libsamba-credentials0Upgrade libsmbclient-develUpgrade libndr-nbt-develUpgrade libsamba-errors0-32bitUpgrade libsamba-util-develUpgrade libsamba-util0-32bitUpgrade libsamba-hostconfig0Upgrade samba-dsdb-modulesUpgrade libdcerpc-binding0Upgrade libtevent-util-develUpgrade libnetapi0-32bitUpgrade libtevent-util0Upgrade libsamba-policy0-python3Upgrade libndr-standard0-32bitUpgrade sambaUpgrade samba-winbind-32bitUpgrade libndr-nbt0Upgrade libnetapi0Upgrade samba-cephUpgrade libsamba-policy-develUpgrade samba-clientUpgrade samba-libs-python3Upgrade libsmbclient0-32bitUpgrade libwbclient0Upgrade libsamba-credentials-develUpgrade samba-winbindUpgrade samba-docUpgrade libdcerpc0-32bitUpgrade libndr-standard0Upgrade samba-libs-32bitUpgrade libdcerpc-develUpgrade samba-pythonUpgrade ctdbUpgrade libsamba-errors-develUpgrade libsmbconf0Upgrade libsamba-util0Upgrade libdcerpc-samr0Upgrade samba-core-develUpgrade libwbclient0-32bitUpgrade libsamba-hostconfig-develUpgrade libndr0Upgrade libndr0-32bitUpgrade libndr1-32bitUpgrade libsamba-credentials0-32bitUpgrade libsmbldap-develUpgrade libsamdb-develUpgrade libwbclient-develUpgrade libndr-krb5pac0Upgrade libndr-krb5pac-develUpgrade libtevent-util0-32bitUpgrade libsamba-passdb-develUpgrade libdcerpc-binding0-32bitUpgrade libsmbclient0Upgrade samba-libs-python3-32bitUpgrade libndr-develUpgrade samba-python3Upgrade libsamdb0Upgrade libsamba-passdb0-32bitUpgrade libnetapi-develUpgrade libsamba-hostconfig0-32bitUpgrade libsamba-passdb0Upgrade libsmbconf-develUpgrade libdcerpc0Upgrade libndr-standard-develUpgrade samba-client-32bitUpgrade libsamdb0-32bitUpgrade libndr-nbt0-32bitUpgrade libndr1Upgrade libsmbconf0-32bitUpgrade libsamba-errors0Upgrade libsmbldap2 | Dec 19, 2019 | Aug 14, 2018 |
| Ubuntu | — | Upgrade samba | Dec 4, 2018 | Aug 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub