Bug 16012 (CVE-2026-3238) - [SECURITY] CVE-2026-3238 unauthenticated udp packet crashes AD DC nbt server
Summary: [SECURITY] CVE-2026-3238 unauthenticated udp packet crashes AD DC nbt server
Status: RESOLVED FIXED
Alias: CVE-2026-3238
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks: 16018
  Show dependency treegraph
 
Reported: 2026-02-25 07:30 UTC by Volker Lendecke
Modified: 2026-06-12 23:43 UTC (History)
1 user (show)

See Also:


Attachments
Security report (2.70 KB, text/plain)
2026-02-25 07:33 UTC, Volker Lendecke
no flags Details
Patch for 4.21 (4.21 KB, patch)
2026-03-05 12:46 UTC, Volker Lendecke
no flags Details
Patch for 4.22 (4.21 KB, patch)
2026-03-05 12:47 UTC, Volker Lendecke
no flags Details
Patch for 4.23 (4.21 KB, patch)
2026-03-05 12:47 UTC, Volker Lendecke
no flags Details
Patch for 4.24 (4.21 KB, patch)
2026-03-05 12:47 UTC, Volker Lendecke
no flags Details
Patch for master (4.21 KB, patch)
2026-03-05 12:49 UTC, Volker Lendecke
vl: ci-passed+
Details
Draft advisory (2.48 KB, text/plain)
2026-03-05 14:40 UTC, Volker Lendecke
dbagnall: review+
Details
Patch for all versions (5.09 KB, patch)
2026-03-06 09:35 UTC, Volker Lendecke
dbagnall: review+
vl: ci-passed+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Volker Lendecke 2026-02-25 07:30:25 UTC

    
Comment 1 Volker Lendecke 2026-02-25 07:33:31 UTC
Created attachment 18867 [details]
Security report
Comment 2 Volker Lendecke 2026-02-26 20:33:38 UTC
Anten Skrabec commented:

Hi there,

I've reserved CVE-2026-3238 for this issue. Please let us know when you have additional information to share so we can ensure the CVE
+metadata is set correctly.

Thanks,
Anten
Comment 3 Volker Lendecke 2026-03-05 12:46:48 UTC
Created attachment 18875 [details]
Patch for 4.21
Comment 4 Volker Lendecke 2026-03-05 12:47:10 UTC
Created attachment 18876 [details]
Patch for 4.22
Comment 5 Volker Lendecke 2026-03-05 12:47:26 UTC
Created attachment 18877 [details]
Patch for 4.23
Comment 6 Volker Lendecke 2026-03-05 12:47:58 UTC
Created attachment 18878 [details]
Patch for 4.24
Comment 7 Volker Lendecke 2026-03-05 12:49:42 UTC
Created attachment 18879 [details]
Patch for master

I have only run a full autobuild on the master patch. I have compiled all the other ones. As this code has not changed for many years, I strongly doubt that the autobuild result will differ for the versions back to 4.21.
Comment 8 Volker Lendecke 2026-03-05 14:40:50 UTC
Created attachment 18880 [details]
Draft advisory
Comment 9 Volker Lendecke 2026-03-05 15:24:04 UTC
In case someone feels inclined to take a look, from my point of view this is done for the moment.
Comment 10 Douglas Bagnall 2026-03-05 23:55:26 UTC
Should we also do nbtd_winsserver_query?:

diff --git i/source4/nbt_server/wins/winsserver.c w/source4/nbt_server/wins/winsserver.c
index a74eae2e42b..8be2ad10813 100644
--- i/source4/nbt_server/wins/winsserver.c
+++ w/source4/nbt_server/wins/winsserver.c
@@ -747,13 +747,16 @@ static void nbtd_winsserver_query(struct loadparm_context *lp_ctx,
        struct nbtd_interface *iface = talloc_get_type(nbtsock->incoming.private_data,
                                                       struct nbtd_interface);
        struct wins_server *winssrv = iface->nbtsrv->winssrv;
-       struct nbt_name *name = &packet->questions[0].name;
+       struct nbt_name *name = NULL;
        struct winsdb_record *rec;
        struct winsdb_record *rec_1b = NULL;
        const char **addresses;
        const char **addresses_1b = NULL;
        uint16_t nb_flags = 0;
 
+       NBTD_ASSERT_PACKET(packet, src, packet->qdcount > 0);
+       name = &packet->questions[0].name;
+
        if (name->type == NBT_NAME_MASTER) {
                goto notfound;
        }
Comment 11 Douglas Bagnall 2026-03-05 23:59:11 UTC
(In reply to Volker Lendecke from comment #7)
> I have only run a full autobuild on the master patch. I have compiled all the other ones. As this code has not changed for many years, I strongly doubt that the autobuild result will differ for the versions back to 4.21.

Agreed.

The patches will apply as far back as 4.0.
Comment 12 Volker Lendecke 2026-03-06 09:33:05 UTC
(In reply to Douglas Bagnall from comment #10)
> Should we also do nbtd_winsserver_query?:

Of course, thanks!!
Comment 13 Volker Lendecke 2026-03-06 09:35:21 UTC
Created attachment 18881 [details]
Patch for all versions

As the patch is really the same for all versions back very very far, I named the one patch appropriately. If this is too difficult for downstream, I'll upload them again with separate names. Running CI on top of master now.
Comment 14 Volker Lendecke 2026-03-06 12:34:41 UTC
private autobuild succeeded
Comment 15 Björn Jacke 2026-04-08 16:35:45 UTC
the security release that was scheduled for tomorrow, will be postponed due to
new problems that have been identified with one of the fixes.

We will announce a new release date as soon as possible after the remaining
issues have been ruled out.
Comment 16 Björn Jacke 2026-05-15 13:01:26 UTC
Scheduled release date is now 2026-05-26.
Comment 17 Stefan Metzmacher 2026-05-26 09:16:08 UTC
I plan to upload the releases in about 3 hours from now...
Comment 18 Samba QA Contact 2026-05-26 12:35:48 UTC
This bug was referenced in samba v4-24-stable (Release samba-4.24.3):

e440829bdd9c9799ac84df703add44f58d2d5c8b
e37b4645bd63be3cbba7b3521a1c858c8231a236
Comment 19 Samba QA Contact 2026-05-26 12:36:36 UTC
This bug was referenced in samba v4-23-stable (Release samba-4.23.8):

9ac7c27d30997e180f9c88d93f0f6e76238eb42f
2d7d92ef35e4496d43dd342c621b31f07d93fa71
Comment 20 Samba QA Contact 2026-05-26 12:37:05 UTC
This bug was referenced in samba v4-22-stable (Release samba-4.22.10):

4798eb7aba91f526d3e88d7dbb3fb06923d891e5
4a53add03f1eb5d44deb76d7e171fc638e9ef8d0
Comment 21 Samba QA Contact 2026-05-26 12:39:01 UTC
This bug was referenced in samba v4-24-test (Release samba-4.24.3):

e440829bdd9c9799ac84df703add44f58d2d5c8b
e37b4645bd63be3cbba7b3521a1c858c8231a236
Comment 22 Samba QA Contact 2026-05-26 12:39:51 UTC
This bug was referenced in samba v4-23-test (Release samba-4.23.8):

9ac7c27d30997e180f9c88d93f0f6e76238eb42f
2d7d92ef35e4496d43dd342c621b31f07d93fa71
Comment 23 Samba QA Contact 2026-05-26 12:40:36 UTC
This bug was referenced in samba v4-22-test (Release samba-4.22.10):

4798eb7aba91f526d3e88d7dbb3fb06923d891e5
4a53add03f1eb5d44deb76d7e171fc638e9ef8d0
Comment 24 Samba QA Contact 2026-05-26 13:55:29 UTC
This bug was referenced in samba master:

20335fb88aaf628de9d243eb9cb39256c613e994
15fce8ff6141d1d4c5a526f6567b8f0e8bbc4261