CVE-2022-2127: Samba: out-of-bounds read in winbind auth_crap
Vulnerability summary
CVE-2022-2127 is a medium (CVSS 5.9) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 1.72% chance of exploitation in the next 30 days, higher than 77.5% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 15 · Related 7Timeline
- 20-07-2023PublishedVulnerability first disclosed.
- 20-11-2025Last modifiedVulnerability information updated.
Description
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.72%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.72% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse15 products
- samba&distro=SUSE Enterprise Storage 7< 4.11.14+git.396.91f4f677472-150200.4.52.5
- samba&distro=SUSE Linux Enterprise High Availability Extension 12 SP4< 4.6.16+git.393.97432483687-3.81.1
- samba&distro=SUSE Linux Enterprise High Availability Extension 15 SP1< 4.9.5+git.564.996810ca1e3-150100.3.82.3
- samba&distro=SUSE Linux Enterprise High Availability Extension 15 SP2< 4.11.14+git.396.91f4f677472-150200.4.52.5
- samba&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 4.9.5+git.564.996810ca1e3-150100.3.82.3
Debian2 products
- samba< 2:4.17.10+dfsg-0+deb12u1 | < 2:4.18.5+dfsg-1
- debian_linux12.0
Fedoraproject1 product
- fedoraEOL37 | 38
Opensuse1 product
- samba&distro=openSUSE Leap 15.4< 4.9.5+git.564.996810ca1e3-150100.3.82.3 | < 4.11.14+git.396.91f4f677472-150200.4.52.5
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0
Samba1 product
- samba≥ 4.16.0, < 4.16.10 | ≥ 4.17.0, < 4.17.9 | ≥ 4.18.0, < 4.18.4
Ubuntu1 product
- sambaAll versions (No fix recorded) | < 2:4.15.13+dfsg-0ubuntu0.20.04.3 | < 2:4.15.13+dfsg-0ubuntu1.2
7 vendors · 22 products
References
22 links
- lists.fedoraproject.org/archives/…X Transferred
- lists.fedoraproject.org/archives/…X Transferred
Show all 22 references
- security.netapp.com/advisory/ntap-20230731-0010/X Transferred
- www.debian.org/security/2023/dsa-5477X Transferred