Log in Start free

Vulnerability · Published Mar 2, 2022 · Assigned by redhat

CVE-2021-3738

High 8.8

In plain English

A high-severity use-after-free in samba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.0%top 18.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20samba4.15.2-r0ALPINE-CVE-2021-3738
Alpine:v3.21samba4.15.2-r0ALPINE-CVE-2021-3738
Alpine:v3.22samba4.15.2-r0ALPINE-CVE-2021-3738
Alpine:v3.23samba4.15.2-r0ALPINE-CVE-2021-3738
Alpine:v3.24samba4.15.2-r0ALPINE-CVE-2021-3738
Debian:12samba2:4.13.14+dfsg-1DEBIAN-CVE-2021-3738
Debian:13samba2:4.13.14+dfsg-1DEBIAN-CVE-2021-3738
Debian:14samba2:4.13.14+dfsg-1DEBIAN-CVE-2021-3738
Ubuntu:22.04:LTSsamba2:4.13.14+dfsg-0ubuntu1UBUNTU-CVE-2021-3738

Affected products (as reported)

VendorProductVersions
n/a samba Affects all versions since samba 4.0 | Fixedin samba v4.15.2, v4.14.10 and v4.13.14

Weakness: CWE-416

References