Use After Free in Samba
CVE-2021-3738
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
Vulnerability class: Use-After-Free
EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Samba
- N/a Samba — versions Affects all versions since samba 4.0 | Fixedin samba v4.15.2, v4.14.10 and v4.13.14
Weakness classification (CWE)
References
- secalert@redhat.com (Vendor Advisory)
- secalert@redhat.com (Patch, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (Third Party Advisory, Issue Tracking)
- secalert@redhat.com (vendor-advisory)
Frequently asked questions
- What is CVE-2021-3738?
- CVE-2021-3738 is a high-severity vulnerability in Samba, classified under Use After Free. CVSS score: 8.8/10. Published 2022-03-02.
- How severe is CVE-2021-3738?
- High severity. CVSS v3 base score is 8.8 out of 10.