CVE-2022-32746: Use After Free
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.
Other sources
As per samba upstream advisory:
Some database modules make a shallow copy of an LDAP add/delete message so they can make modifications to its elements without affecting the original message. Each element in a message points to an array of values, and these arrays are shared between the original message and the copy.
The issue arises when a database module adds new values to an existing array. A call to realloc() increases the array's size to accommodate new elements, but at the same time, frees the old array. This leaves the original message element with a dangling pointer to a now-freed array. When the database audit logging module subsequently logs the details of the original message, it will access this freed data, generally resulting in corrupted log output or a crash.
The code paths susceptible to this issue are reachable when certain specific attributes, such as userAccountControl, are added or modified. These attributes are not editable by default without having a privilege assigned, such as Write Property.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.17.12+dfsg-0+deb12u4Fixed in 2:4.22.11+dfsg-0+deb13u1Fixed in 2:4.22.10+dfsg-0+deb13u2Fixed in 2:4.25.1+dfsg-1 - Upgrade
Upgrade
alpine/sambato a version that resolves this vulnerability.Fixed in 4.14.14-r0 - Upgrade
Upgrade
alpine/sambato a version that resolves this vulnerability.Fixed in 4.15.12-r0 - Upgrade
Upgrade
alpine/sambato a version that resolves this vulnerability.Fixed in 4.15.9-r0 - Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.16.4+dfsg-1 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.16.4 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.15.9 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.14.14
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-32746.
What is the severity of CVE-2022-32746?
The severity of CVE-2022-32746 is medium (5.4).
What is the affected software?
The affected software is Samba Samba versions 4.3.0 to 4.14.14, 4.15.0 to 4.15.9, and 4.16.0 to 4.16.4.
What is the description of CVE-2022-32746?
CVE-2022-32746 is a use-after-free issue in the Samba AD LDAP server, where the AD DC database audit logging module can access freed LDAP message values, resulting in a use-after-free issue when modifying certain privileged attributes.
How can I fix CVE-2022-32746?
To fix CVE-2022-32746, it is recommended to update Samba to a version that includes the fix provided by the vendor.