CVE-2020-10760: Use After Free
A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba.
Other sources
As per upstream advisory:
Samba 4.5 and later implements VLV - Virtual List View, and Samba 4.10 and later reimplemented the pagedresults control using similar code.
This code is more memory-efficient, storing only a pointer to the object, not the returned object. However this means parts of the original request must be retained
When these controls are used by a client that connects to the Global Catalog server, these modules failed to correctly retain the control data along with the request, causing a use-after-free and an abort when this is detected by the talloc library.
NOTE WELL: Unsupported Samba versions before Samba 4.7 use a single process for the LDAP servers.
All versions of Samba after Samba 4.11 use the 'prefork' process model to create a shared connection pool. Crashing servers are restarted, but service is disrupted.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10760?
CVE-2020-10760 is a use-after-free vulnerability found in all Samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in an AC DC configuration.
How does CVE-2020-10760 impact Samba LDAP server?
CVE-2020-10760 can be exploited by a Samba LDAP user to cause a denial of service (crash) in the Samba LDAP server.
What is the severity of CVE-2020-10760?
CVE-2020-10760 has a severity rating of 6.5 (Medium).
Which versions of Samba LDAP server are affected by CVE-2020-10760?
All Samba LDAP server versions before 4.10.17, before 4.11.11, and before 4.12.4 are affected by CVE-2020-10760.
How can I fix CVE-2020-10760 in my Samba LDAP server?
To fix CVE-2020-10760, update your Samba LDAP server to version 4.10.17, 4.11.11, or 4.12.4, depending on the version you are using.