CVE-2022-2127 Samba: out-of-bounds read in winbind auth_crap
A maliciously crafted NTLM authentication request can trigger an out-of-bounds read in Samba Winbind, potentially causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2127?
CVE-2022-2127 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 20 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
Weakness: CWE-125
Which versions are affected by CVE-2022-2127?
It affects 4 products.
Linux distribution packages (17)
samba SUSE:Enterprise Storage 7 | All versions | 4.11.14+git.396.91f4f677472-150200.4.52.5 |
samba SUSE:Linux Enterprise High Availability Extension 12 SP4 | All versions | 4.6.16+git.393.97432483687-3.81.1 |
samba SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 4.9.5+git.564.996810ca1e3-150100.3.82.3 |
samba SUSE:Linux Enterprise High Availability Extension 15 SP2 | All versions | 4.11.14+git.396.91f4f677472-150200.4.52.5 |
samba SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 4.9.5+git.564.996810ca1e3-150100.3.82.3 |
samba SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 4.11.14+git.396.91f4f677472-150200.4.52.5 |
samba SUSE:Linux Enterprise Server 12 SP4-ESPOS | All versions | 4.6.16+git.393.97432483687-3.81.1 |
samba SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 4.6.16+git.393.97432483687-3.81.1 |
samba SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 4.9.5+git.564.996810ca1e3-150100.3.82.3 |
samba SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 4.11.14+git.396.91f4f677472-150200.4.52.5 |
samba SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 4.6.16+git.393.97432483687-3.81.1 |
samba SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 4.9.5+git.564.996810ca1e3-150100.3.82.3 |
samba SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 4.11.14+git.396.91f4f677472-150200.4.52.5 |
samba SUSE:OpenStack Cloud 9 | All versions | 4.6.16+git.393.97432483687-3.81.1 |
samba SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.6.16+git.393.97432483687-3.81.1 |
samba openSUSE:Leap 15.4 | All versions | 4.11.14+git.396.91f4f677472-150200.4.52.5 |
samba openSUSE:Leap 15.4 | All versions | 4.9.5+git.564.996810ca1e3-150100.3.82.3 |
Products include Debian Debian Linux, Fedoraproject Fedora, Redhat Enterprise Linux, Samba Samba.
How do I fix CVE-2022-2127?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-2127 being exploited?
There is no known exploitation of CVE-2022-2127 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-44029, AZL-44625, CLSA-2023-1692293238, CLSA-2023-1692293872, CLSA-2026-1779117827, DEBIAN-CVE-2022-2127 and 6 more.