Double-free error in Samba - CVE-2018-16841
Published: November 28, 2018
Vulnerability identifier: #VU16155
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16841
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition.
The vulnerability exists due to Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ when configured to accept smart-card authentication. A remote attacker can trigger double-free with talloc_free() and directly calls abort() and cause the KDC process to crash.
Affected software
Samba
Arch Linux
Debian Linux
Gentoo Linux
Slackware Linux
Fedora
busybox (Alpine package)
samba (Alpine package)
samba
Arch Linux
Debian Linux
Gentoo Linux
Slackware Linux
Fedora
busybox (Alpine package)
samba (Alpine package)
samba
How to mitigate CVE-2018-16841
The vulnerability has been fixed in the version 4.7.12, 4.8.7, and 4.9.3.
Samba - addressed in versions 4.7.12, 4.8.7, 4.9.3
samba (Alpine package) - update to 4.6.16-r2
samba - addressed in versions 4.8.7-0.fc28, 4.9.3-0.fc29
samba (Alpine package) - update to 4.6.16-r2
samba - addressed in versions 4.8.7-0.fc28, 4.9.3-0.fc29