CVE-2021-3738
published 2022-03-02CVE-2021-3738: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These…
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.89%
77.3th percentile
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.13.14+dfsg-1 (bookworm) | samba 2:4.13.14+dfsg-1 (bookworm) |
| msrc | azl3_samba_4.18.3-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| samba | samba | — | — |
| samba | samba | >= 0 < 2:4.13.13+dfsg-1~deb11u2 | 2:4.13.13+dfsg-1~deb11u2 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-1 | 2:4.13.14+dfsg-1 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-1 | 2:4.13.14+dfsg-1 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-1 | 2:4.13.14+dfsg-1 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-0ubuntu0.20.04.4 | 2:4.13.14+dfsg-0ubuntu0.20.04.4 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-0ubuntu0.20.04.3 | 2:4.13.14+dfsg-0ubuntu0.20.04.3 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-0ubuntu0.20.04.1 | 2:4.13.14+dfsg-0ubuntu0.20.04.1 |
| samba | samba | >= 4.0.0 < 4.13.14 | 4.13.14 |
| samba | samba | >= 4.14.0 < 4.14.10 | 4.14.10 |
| samba | samba | >= 4.15.0 < 4.15.2 | 4.15.2 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jrfc-f73c-qmrr: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'
ghsa_unreviewed·2022-03-04
CVE-2021-3738 [HIGH] CWE-416 GHSA-jrfc-f73c-qmrr: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
OSV
CVE-2021-3738: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'
osv·2022-03-02·CVSS 8.8
CVE-2021-3738 [HIGH] CVE-2021-3738: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
OSV
samba regression
osv·2021-12-13·CVSS 5.9
[MEDIUM] samba regression
samba regression
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced a regression in Kerberos authentication in certain environments.
Please see the following upstream bug for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14922
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox
OSV
samba regressions
osv·2021-12-06·CVSS 5.9
[MEDIUM] samba regressions
samba regressions
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced regressions in name mapping and backups.
Please see the following upstream bugs for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14901
https://bugzilla.samba.org/show_bug.cgi?id=14918
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba
OSV
samba vulnerabilities
osv·2021-11-11·CVSS 5.9
CVE-2016-2124 [MEDIUM] samba vulnerabilities
samba vulnerabilities
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos
tickets issues by an RODC. An RODC could print administrator tickets,
contrary to expectations. (CVE-2020-25718)
Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets.
Delegated administrators could possibly use this issue to impersonate
accounts, leading to total domain compromise.
Microsoft
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam
vendor_msrc·2022-03-08·CVSS 8.8
CVE-2021-3738 [HIGH] CWE-416 In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared the user credentials state was only pointed at and when one connection within that association group ended the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefit
Ubuntu
Samba regression
vendor_ubuntu·2021-12-13·CVSS 5.9
[MEDIUM] Samba regression
Title: Samba regression
Summary: USN-5142-1 introduced a regression in Samba.
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced a regression in Kerberos authentication in certain environments.
Please see the following upstream bug for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14922
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
An
Ubuntu
Samba regressions
vendor_ubuntu·2021-12-06·CVSS 5.9
[MEDIUM] Samba regressions
Title: Samba regressions
Summary: USN-5142-1 introduced regressions in Samba.
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced regressions in name mapping and backups.
Please see the following upstream bugs for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14901
https://bugzilla.samba.org/show_bug.cgi?id=14918
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain mem
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2021-11-11·CVSS 5.9
CVE-2020-25721 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos
tickets issues by an RODC. An RODC could print administrator tickets,
contrary to expectations. (CVE-2020-25718)
Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets.
Delegated administrators could possibly use this issu
Red Hat
samba: Use after free in Samba AD DC RPC server
vendor_redhat·2021-11-09·CVSS 8.8
CVE-2021-3738 [HIGH] CWE-416 samba: Use after free in Samba AD DC RPC server
samba: Use after free in Samba AD DC RPC server
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
Package: samba (Red Hat Enterprise Linux 6) - Not affected
Package: samba4 (Red Hat Enterprise Linux 6) - Not affect
Debian
CVE-2021-3738: samba - In DCE/RPC it is possible to share the handles (cookies for resource state) betw...
vendor_debian·2021·CVSS 8.8
CVE-2021-3738 [HIGH] CVE-2021-3738: samba - In DCE/RPC it is possible to share the handles (cookies for resource state) betw...
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
Scope: local
bookworm: resolved (fixed in 2:4.13.14+dfsg-1)
bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u2)
forky: resolved (fixed in 2:4.13.14+dfsg-1)
sid: res
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2021726https://bugzilla.samba.org/show_bug.cgi?id=14468https://security.gentoo.org/glsa/202309-06https://www.samba.org/samba/security/CVE-2021-3738.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=2021726https://bugzilla.samba.org/show_bug.cgi?id=14468https://security.gentoo.org/glsa/202309-06https://www.samba.org/samba/security/CVE-2021-3738.html
2022-03-02
Published