samba: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechan...
CVE-2021-3738 is fixed in 16 products on 1 platform, first by ctdb 2:4.13.14+dfsg-0ubuntu0.20.04.1, released November 8, 2021. It is not reported as exploited. Patch Radar priority: High.
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ctdb · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | ctdb 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| ctdb · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | ctdb 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| libnss-winbind · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | libnss-winbind 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| libnss-winbind · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | libnss-winbind 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| libpam-winbind · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | libpam-winbind 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| libpam-winbind · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | libpam-winbind 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| libsmbclient · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | libsmbclient 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| libsmbclient · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | libsmbclient 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| libwbclient0 · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | libwbclient0 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| libwbclient0 · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | libwbclient0 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| python3-samba · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | python3-samba 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| python3-samba · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | python3-samba 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| registry-tools · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | registry-tools 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| registry-tools · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | registry-tools 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba · Debian 12.15 (bookworm) | 2:4.13.14+dfsg-1 | DEBIAN-CVE-2021-3738 | Mar 2, 2022 |
| samba · Debian 13.5 (trixie) | 2:4.13.14+dfsg-1 | DEBIAN-CVE-2021-3738 | Mar 2, 2022 |
| samba · Debian 14 | 2:4.13.14+dfsg-1 | DEBIAN-CVE-2021-3738 | Mar 2, 2022 |
| samba · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba-common · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba-common 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba-common · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba-common 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba-common-bin · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba-common-bin 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba-common-bin · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba-common-bin 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba-dsdb-modules · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba-dsdb-modules 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba-dsdb-modules · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba-dsdb-modules 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba-libs · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba-libs 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba-libs · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba-libs 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba-testsuite · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba-testsuite 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba-testsuite · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba-testsuite 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| samba-vfs-modules · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | samba-vfs-modules 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| samba-vfs-modules · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | samba-vfs-modules 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| smbclient · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | smbclient 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| smbclient · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | smbclient 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
| winbind · Ubuntu 20.04 LTS (focal) | 2:4.13.14+dfsg-0ubuntu0.20.04.1 | winbind 2:4.13.14+dfsg-0ubuntu0.20.04.1 | Nov 8, 2021 |
| winbind · Ubuntu 22.04.1 LTS (jammy) | 2:4.13.14+dfsg-0ubuntu1 | winbind 2:4.13.14+dfsg-0ubuntu1 | Nov 8, 2021 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.