Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Feb 20, 2019 | Nov 28, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 28, 2018 |
| Debian | — | Upgrade samba | Nov 28, 2018 | Aug 14, 2018 |
| Freebsd | — | Upgrade samba47Upgrade samba49Upgrade samba46Upgrade samba48 | Nov 28, 2018 | Aug 14, 2018 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Mar 27, 2020 | Nov 28, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-winbind-modulesUpgrade samba-winbindUpgrade sambaUpgrade libsmbclientUpgrade ctdbUpgrade samba-commonUpgrade samba-pidlUpgrade python3-samba-testUpgrade samba-libsUpgrade python3-sambaUpgrade ctdb-testsUpgrade python2-sambaUpgrade samba-winbind-clientsUpgrade samba-winbind-krb5-locatorUpgrade samba-test-libsUpgrade samba-testUpgrade libwbclientUpgrade samba-client-libsUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-common-libsUpgrade samba-dc-libsUpgrade samba-krb5-printing | Jul 26, 2019 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.9.6-11.4.11.0.1.1.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.9.6-11.4.11.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Nov 28, 2018 |
| Samba | — | Upgrade to Samba version 4.7.12Upgrade to Samba version 4.9.3Upgrade to Samba version 4.8.7 | Dec 4, 2018 | Nov 28, 2018 |
| Suse | — | Upgrade samba-winbindUpgrade libdcerpc-samr-develUpgrade libsamba-hostconfig0Upgrade samba-libs-python3Upgrade libndr-nbt-develUpgrade libsamba-policy0-python3Upgrade libsmbldap2-32bitUpgrade samba-libsUpgrade libdcerpc-binding0Upgrade libsamba-credentials-develUpgrade libsmbclient0-32bitUpgrade ctdbUpgrade libsamba-util0-32bitUpgrade libsmbclient-develUpgrade libsamba-errors0-32bitUpgrade libnetapi0Upgrade samba-clientUpgrade samba-libs-32bitUpgrade libnetapi0-32bitUpgrade sambaUpgrade samba-cephUpgrade libsamba-policy-develUpgrade libtevent-util0Upgrade libsamba-policy0Upgrade samba-dsdb-modulesUpgrade samba-docUpgrade samba-winbind-32bitUpgrade libdcerpc0-32bitUpgrade libsamba-credentials0Upgrade libndr-standard0-32bitUpgrade libtevent-util-develUpgrade libndr-standard0Upgrade libndr-krb5pac0-32bitUpgrade samba-pythonUpgrade libsamba-policy-python3-develUpgrade libndr-nbt0Upgrade libdcerpc-develUpgrade libsamba-util-develUpgrade libwbclient0Upgrade libsamdb-develUpgrade libsmbldap2Upgrade libndr0-32bitUpgrade libsamba-hostconfig0-32bitUpgrade libdcerpc-samr0Upgrade libsamba-util0Upgrade libndr1Upgrade libndr0Upgrade libndr-standard-develUpgrade libndr-krb5pac-develUpgrade libsamba-errors0Upgrade libwbclient0-32bitUpgrade samba-python3Upgrade libsamba-passdb0-32bitUpgrade libndr1-32bitUpgrade libsmbldap-develUpgrade samba-core-develUpgrade libsmbconf0Upgrade libsamba-hostconfig-develUpgrade libsamba-credentials0-32bitUpgrade libdcerpc-binding0-32bitUpgrade libsamba-passdb-develUpgrade libsmbclient0Upgrade libsamba-errors-develUpgrade libtevent-util0-32bitUpgrade libsmbconf0-32bitUpgrade samba-client-32bitUpgrade libsamba-passdb0Upgrade libdcerpc0Upgrade libnetapi-develUpgrade libndr-nbt0-32bitUpgrade libsamdb0-32bitUpgrade samba-libs-python3-32bitUpgrade libsamdb0Upgrade libsmbconf-develUpgrade libndr-develUpgrade libndr-krb5pac0Upgrade libwbclient-devel | Dec 19, 2019 | Aug 14, 2018 |
| Ubuntu | — | Upgrade samba | Dec 4, 2018 | Aug 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub