Bug 2108215 (CVE-2022-32746) - CVE-2022-32746 samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request
Summary: CVE-2022-32746 samba: AD users can induce a use-after-free in the server proc...
Alias: CVE-2022-32746
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 2109016 2109017 2111734 2111735 2111743
Blocks: 2095310 2095313
TreeView+ depends on / blocked
Reported: 2022-07-18 15:36 UTC by Mauro Matteo Cascella
Modified: 2023-12-07 15:26 UTC (History)
19 users (show)

Fixed In Version: samba 4.16.4, samba 4.15.9, samba 4.14.14
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.
Clone Of:
Last Closed: 2022-12-05 23:03:23 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:7730 0 None None None 2022-11-08 10:18:34 UTC
Red Hat Product Errata RHSA-2022:8318 0 None None None 2022-11-15 10:56:13 UTC

Description Mauro Matteo Cascella 2022-07-18 15:36:49 UTC
As per samba upstream advisory:

Some database modules make a shallow copy of an LDAP add/delete message so they can make modifications to its elements without affecting the original message. Each element in a message points to an array of values, and these arrays are shared between the original message and the copy.

The issue arises when a database module adds new values to an existing array. A call to realloc() increases the array's size to accommodate new elements, but at the same time, frees the old array. This leaves the original message element with a dangling pointer to a now-freed array. When the database audit logging module subsequently logs the details of the original message, it will access this freed data, generally resulting in corrupted log output or a crash.

The code paths susceptible to this issue are reachable when certain specific attributes, such as userAccountControl, are added or modified. These attributes are not editable by default without having a privilege assigned, such as Write Property.

Comment 2 Sandipan Roy 2022-07-28 04:09:37 UTC
Created libldb tracking bugs for this issue:

Affects: fedora-all [bug 2111735]

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2111734]

Comment 4 errata-xmlrpc 2022-11-08 10:18:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7730 https://access.redhat.com/errata/RHSA-2022:7730

Comment 5 errata-xmlrpc 2022-11-15 10:56:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8318 https://access.redhat.com/errata/RHSA-2022:8318

Comment 6 Product Security DevOps Team 2022-12-05 23:03:19 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.