CVE-2018-16841

    Dashboard / Vulnerabilities / CVE-2018-16841

    CVE-2018-16841

    Published: 28 Nov 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.

    References: http://www.securityfocus.com/bid/106023, https://security.gentoo.org/glsa/202003-52, https://security.netapp.com/advisory/ntap-20181127-0001/, https://usn.ubuntu.com/3827-1/, https://usn.ubuntu.com/3827-2/, https://www.debian.org/security/2018/dsa-4345, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16841, https://www.samba.org/samba/security/CVE-2018-16841.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b85f6018c803fb9aad82820d4b5505179ec5bac3
    Fixed -b7d190f89d7674cf58a02486fa9887d393918611

    Affected versions

    samba-4.8.6
    samba-4.8.5
    samba-4.8.3
    samba-4.8.2
    samba-4.8.1
    samba-4.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-16841 | CVE-DB