CVE-2022-32742 Information disclosure in samba
SMB1 write requests lacking range checks allow server memory contents to be written to files or printers, disclosing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-32742?
CVE-2022-32742 is a medium-severity vulnerability in Samba Samba, published on 25 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).
Weakness: CWE-200
Which versions are affected by CVE-2022-32742?
It affects 1 product.
Linux distribution packages (40)
ctdb AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
libsmbclient AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
libsmbclient-devel AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
libwbclient AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
libwbclient-devel AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
python3-samba AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
python3-samba-test AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-client AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-client-libs AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-common AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-common-libs AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-common-tools AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-devel AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-krb5-printing AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-libs AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-pidl AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-test AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-test-libs AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-vfs-iouring AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-winbind AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-winbind-clients AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-winbind-krb5-locator AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-winbind-modules AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
samba-winexe AlmaLinux:8 | All versions | 4.15.5-10.el8_6 |
ctdb AlmaLinux:9 | All versions | 4.16.4-101.el9 |
libsmbclient AlmaLinux:9 | All versions | 4.16.4-101.el9 |
libsmbclient-devel AlmaLinux:9 | All versions | 4.16.4-101.el9 |
libwbclient AlmaLinux:9 | All versions | 4.16.4-101.el9 |
libwbclient-devel AlmaLinux:9 | All versions | 4.16.4-101.el9 |
python3-samba AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-client AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-client-libs AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-common AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-common-libs AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-common-tools AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-devel AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-krb5-printing AlmaLinux:9 | All versions | 4.16.4-101.el9 |
samba-libs AlmaLinux:9 | All versions | 4.16.4-101.el9 |
Products include Samba Samba.
How do I fix CVE-2022-32742?
Apply the vendor's patch.
Is CVE-2022-32742 being exploited?
There is no known exploitation of CVE-2022-32742 in the wild and no public exploit code.
Other vulnerabilities in Samba Samba
Sources
Also known as ALPINE-CVE-2022-32742, ALSA-2022:7111, ALSA-2022:8317, AZL-10736, AZL-37012, CLSA-2022-1668546881 and 17 more.