Headline
CVE-2022-2127: Samba - Security Announcement Archive
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
CVE-2022-2127.html:
=========================================================== == Subject: Out-Of-Bounds read in winbind AUTH_CRAP == == CVE ID#: CVE-2022-2127 == == Versions: All versions up to 4.18.4, 4.17.9 and 4.16.10. == == Summary: When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it. ===========================================================
=========== Description ===========
When doing NTLM authentication, the client sends replies to cryptographic challenges back to the server. These replies have variable length. Winbind did not properly bounds-check the lan manager response length, which despite the lan manager version no longer being used is still part of the protocol.
If the system is running Samba’s ntlm_auth as authentication backend for services like Squid (or a very unusual configuration with FreeRADIUS), the vulnarebility is remotely exploitable
If not so configured, or to exploit this vulnerability locally, the user must have access to the privileged winbindd UNIX domain socket (a subdirectory with name ‘winbindd_privileged’ under "state directory", as set in the smb.conf).
This access is normally only given so special system services like Squid or FreeRADIUS, that use this feature.
================== Patch Availability ==================
Patches addressing both these issues have been posted to:
https://www.samba.org/samba/security/
Additionally, Samba 4.18.5, 4.17.10 and 4.16.11 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible.
================== CVSSv3 calculation ==================
A local exploit, for systems without ntlm_auth configured:
CVSS3.1:AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (4.4)
The remote exploit With ntlm_auth configured:
CVSS3.1:AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9)
========== Workaround ==========
Delegated access to this facility is done via group ownership and group membership.
The group owner of the ‘winbindd_privileged’ subfolder under the path given by testparm -s /path/to/smb.conf --parameter-name=’state directory’ can be changed to root, or the group members reduced, if the NTLM authentication feature of tools like Squid and FreeRADIUS is not in use.
The 0750 permissions must however be retained, as winbindd will otherwise fail to start.
As reassurance, smbd will continue to use this feature and will always access this path as root.
======= Credits =======
Found through a coverity finding, fixed by the Samba Team.
========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ==========================================================
Related news
Gentoo Linux Security Advisory 202402-28 - Multiple vulnerabilities have been discovered in Samba, the worst of which can lead to remote code execution. Versions greater than or equal to 4.18.9 are affected.
Red Hat Security Advisory 2023-7139-01 - An update for samba, evolution-mapi, and openchangeis now available for Red Hat Enterprise Linux 8. Issues addressed include out of bounds read and path disclosure vulnerabilities.
Debian Linux Security Advisory 5477-1 - Several vulnerabilities have been discovered in Samba, which could result in information disclosure, denial of service or insufficient enforcement of security-relevant config directives.