CVE-2022-2127 json
Samba: out-of-bounds read in winbind auth_crap
published 3y ago modified 4d ago also EUVD-2022-34413
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
Patch / fix
- Red Hat Red Hat Enterprise Linux 8 0:4.18.6-1.el8
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:4.15.5-15.el8_6
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:4.17.5-5.el8_8
- Red Hat Red Hat Enterprise Linux 9 0:4.18.6-100.el9
- Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 0:4.15.5-15.el8_6
- samba Debian 12 2:4.17.10+dfsg-0+deb12u1
- samba Debian 14, Debian 13 2:4.18.5+dfsg-1
debian advisories DEBIAN-CVE-2022-2127
- samba Ubuntu 20.04 LTS 2:4.15.13+dfsg-0ubuntu0.20.04.3
- samba Ubuntu 22.04 LTS 2:4.15.13+dfsg-0ubuntu1.2
ubuntu advisories UBUNTU-CVE-2022-2127
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- samba rhev hypervisor 4.4, RHEL 8.6 EUS 4.15.5-15.el8_6
- libwbclient rhev hypervisor 4.4, RHEL 8.6 EUS 4.15.5-15.el8_6
- libsmbclient rhev hypervisor 4.4, RHEL 8.6 EUS 4.15.5-15.el8_6
- samba-common rhev hypervisor 4.4, RHEL 8.6 EUS 4.15.5-15.el8_6
- samba RHEL 8 4.18.6-1.el8
- ctdb RHEL 8 4.18.6-1.el8
- libnetapi RHEL 8 4.18.6-1.el8
- samba-libs RHEL 8 4.18.6-1.el8
red hat advisories RHSA-2024:0423RHSA-2024:0580RHSA-2023:7139RHSA-2023:6667
- samba SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +3 more 4.11.14+git.396.91f4f677472-150200.4.52.5
- samba Enterprise Storage 7 4.13.13+git.643.8caa136952b-150200.3.26.3
- samba SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 4.15.13+git.663.9c654e06cdb-150300.3.57.5
- samba SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS +2 more 4.9.5+git.564.996810ca1e3-150100.3.82.3
- samba SLE Module for Basesystem 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +4 more 4.15.13+git.663.9c654e06cdb-150400.3.28.1
- samba SLE Module for Basesystem 15 SP5, SLE High Availability Extension 15 SP5, openSUSE Leap 15.5 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
- samba SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 +1 more 4.15.13+git.621.c8ae836ff82-3.85.1
- samba SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS +3 more 4.6.16+git.393.97432483687-3.81.1
suse advisories SUSE-SU-2023:3358-1SUSE-SU-2023:3066-1SUSE-SU-2023:3060-1SUSE-SU-2023:3017-1SUSE-SU-2023:2930-1SUSE-SU-2023:2929-1
- samba openSUSE Tumbleweed 4.18.5+git.313.c8e274c7852-1.1
opensuse advisories openSUSE-SU-2024:13071-1
- samba AlmaLinux 8 4.18.6-1.el8
- ctdb AlmaLinux 8 4.18.6-1.el8
- libnetapi AlmaLinux 8 4.18.6-1.el8
- samba-libs AlmaLinux 8 4.18.6-1.el8
- samba-pidl AlmaLinux 8 4.18.6-1.el8
- samba-test AlmaLinux 8 4.18.6-1.el8
- libwbclient AlmaLinux 8 4.18.6-1.el8
- samba-tools AlmaLinux 8 4.18.6-1.el8
almalinux advisories ALSA-2023:7139ALSA-2023:6667
- openchange Rocky Linux 8 2.3-32.el8
- evolution-mapi Rocky Linux 8 3.28.3-8.el8
rocky linux advisories RLSA-2023:7139
Is CVE-2022-2127 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-2127 updated cvss 5.9
samba: out-of-bounds read in winbind AUTH_CRAP
-
Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 more Red Hat Enterprise Linux 7 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +18 more Red Hat Storage 3 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +21 moreaffected: no fix planned “Out of support scope”
-
Red Hat CodeReady Linux Builder (v. 8) samba-devel 4.18.6-1.el8, ctdb-debuginfo 4.18.6-1.el8, libnetapi-devel 4.18.6-1.el8, samba-debuginfo 4.18.6-1.el8, libwbclient-devel 4.18.6-1.el8, samba-debugsource 4.18.6-1.el8, +24 morefixed: vendor fix RHSA-2023:7139
-
Red Hat CodeReady Linux Builder (v. 9) samba-pidl 4.18.6-100.el9, samba-test 4.18.6-100.el9, samba-test-libs 4.18.6-100.el9, python3-samba-test 4.18.6-100.el9fixed: vendor fix RHSA-2023:6667
-
Red Hat CodeReady Linux Builder EUS (v.8.6) samba-devel 4.15.5-15.el8_6, ctdb-debuginfo 4.15.5-15.el8_6, samba-debuginfo 4.15.5-15.el8_6, libwbclient-devel 4.15.5-15.el8_6, samba-debugsource 4.15.5-15.el8_6, libsmbclient-devel 4.15.5-15.el8_6, +17 morefixed: vendor fix RHSA-2024:0423
-
Red Hat CodeReady Linux Builder EUS (v.8.8) samba-devel 4.17.5-5.el8_8, ctdb-debuginfo 4.17.5-5.el8_8, libnetapi-devel 4.17.5-5.el8_8, samba-debuginfo 4.17.5-5.el8_8, libwbclient-devel 4.17.5-5.el8_8, samba-debugsource 4.17.5-5.el8_8, +24 morefixed: vendor fix RHSA-2024:0580
-
Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring 4.18.6-1.el8fixed: vendor fix RHSA-2023:7139
-
Red Hat Enterprise Linux AppStream (v. 9) samba-client 4.18.6-100.el9, samba-winexe 4.18.6-100.el9, samba-vfs-iouring 4.18.6-100.el9, samba-krb5-printing 4.18.6-100.el9, samba-winbind-clients 4.18.6-100.el9, samba-winbind-krb5-locator 4.18.6-100.el9fixed: vendor fix RHSA-2023:6667
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) samba-vfs-iouring 4.15.5-15.el8_6fixed: vendor fix RHSA-2024:0423
show 8 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) samba-vfs-iouring 4.17.5-5.el8_8fixed: vendor fix RHSA-2024:0580
-
Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.18.6-1.el8, samba 4.18.6-1.el8, libnetapi 4.18.6-1.el8, samba-libs 4.18.6-1.el8, samba-pidl 4.18.6-1.el8, samba-test 4.18.6-1.el8, +22 morefixed: vendor fix RHSA-2023:7139
-
Red Hat Enterprise Linux BaseOS (v. 9) samba 4.18.6-100.el9, libnetapi 4.18.6-100.el9, samba-libs 4.18.6-100.el9, libwbclient 4.18.6-100.el9, samba-tools 4.18.6-100.el9, libsmbclient 4.18.6-100.el9, +12 morefixed: vendor fix RHSA-2023:6667
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) ctdb 4.15.5-15.el8_6, samba 4.15.5-15.el8_6, samba-libs 4.15.5-15.el8_6, samba-pidl 4.15.5-15.el8_6, samba-test 4.15.5-15.el8_6, libwbclient 4.15.5-15.el8_6, +15 morefixed: vendor fix RHSA-2024:0423
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) ctdb 4.17.5-5.el8_8, samba 4.17.5-5.el8_8, libnetapi 4.17.5-5.el8_8, samba-libs 4.17.5-5.el8_8, samba-pidl 4.17.5-5.el8_8, samba-test 4.17.5-5.el8_8, +22 morefixed: vendor fix RHSA-2024:0580
-
Red Hat Enterprise Linux Resilient Storage (v. 9) ctdb 4.18.6-100.el9fixed: vendor fix RHSA-2023:6667
-
Red Hat Virtualization 4 Hypervisor for RHEL 8 samba 4.15.5-15.el8_6, libwbclient 4.15.5-15.el8_6, libsmbclient 4.15.5-15.el8_6, samba-common 4.15.5-15.el8_6, samba-client-libs 4.15.5-15.el8_6, samba-common-libs 4.15.5-15.el8_6fixed: vendor fix RHSA-2024:0423
-
Red Hat Enterprise Linux AppStream (v. 8) openchange 2.3-32.el8, evolution-mapi 3.28.3-8.el8, evolution-mapi-langpacks 3.28.3-8.el8 Red Hat Enterprise Linux AppStream (v. 9) openchange 2.3-41.el9, evolution-mapi 3.40.1-6.el9, evolution-mapi-langpacks 3.40.1-6.el9not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Storage 3
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
access.redhat.com
/errata/RHSA-2023:6667
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2023:7139
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2024:0423
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:0580
vendor-advisory
-
samba.org
/samba/security/CVE-2022-2127.html
mitigation, vendor-advisory
-
access.redhat.com
/security/cve/CVE-2022-2127
vdb-entry, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2222791
issue-tracking, third-party-advisory
- lists.debian.org /debian-lts-announce/2024/04/msg00015.html
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/
- security.netapp.com /advisory/ntap-20230731-0010/
- debian.org /security/2023/dsa-5477
Sources
- CVE List CVE-2022-2127
- NVD CVE-2022-2127
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.