CVE-2022-45142 Security feature bypass in Samba

High 7.5 Published 6 Mar 2023 Updated 6 Mar 2025

A logic inversion in Heimdal's GSSAPI implementation allows attackers to bypass message integrity code validation in Samba environments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-45142?

CVE-2022-45142 is a high-severity vulnerability in Samba, published on 6 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

Weakness: CWE-354

Which versions are affected by CVE-2022-45142?

It affects 1 product.

Products include Heimdal Project Heimdal.

How do I fix CVE-2022-45142?

Apply the vendor's patch.

Is CVE-2022-45142 being exploited?

There is no known exploitation of CVE-2022-45142 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2022-45142, AZL-25604, AZL-34797, CLEANSTART-2024-GP69623, DEBIAN-CVE-2022-45142, DLA-3311-1 and 7 more.