Skip to content

CVE-2026-58224 on CTRL-OS 26.05

Aliases: CVE-2026-58224

Packages: samba

Status: Plausible

Advisory Information

===========================================================
== Subject:     The CTDB protocol has bounds checking issues
==
== CVE ID#:     CVE-2026-58224
==
== Versions:    All versions since 4.2
==

== Summary:     CTDB fails to do integrity checking of received
                packets.  This includes failure to check field lengths
                against packet lengths when unmarshalling packets.

===========================================================

===========
Description
===========

CTDB fails to do a number of integrity checks on received packets.
This includes:

* checking of field lengths against packet lengths when unmarshalling
  packets;
* edge-case checking of string NUL-termination; and
* sanity checking of overall packet lengths.

This can result in denial of service (DoS) (due to crash or out-of
memory) and possible limited disclosure of adjacent memory
allocations.

Most of the issues are in the protocol handling for the CTDB private
network.  Some are in handling of the CTDB event protocol, used on a
local Unix domain socket.

The impact is mitigated by documented protections that should be in
place on the CTDB private network:

  It is strongly recommended that the private addresses are configured
  on a private network that is separate from client networks.  This is
  because the CTDB protocol is both unauthenticated and unencrypted.
  [...]

Overall sanity checking of packet lengths to avoid out-of-memory DoS
is not being addressed.  No size limit is currently placed on packets
sent by CTDB, so implementing an arbitrary restriction on the size of
received packets could result in the rejection of valid packets.

Part of the solution to all of these issues is strengthening the
documentation about securing the private network.

================== Patch Availability ==================

Patches addressing this issue have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba 4.24.5, 4.23.11, 4.22.10 have been issued as
security releases to correct the defect. Samba administrators are
advised to upgrade to these releases or apply the patch as soon as
possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H 7.1

==========
Workaround
==========

Secure the CTDB private network, as documented.

=======
Credits
=======

The top-level CTDB protocol issues were originally reported by Tristan
Madani of Talence Security.

Out-of-memory DoS issues, along with issues in the event protocol and
the control part of the main protocol were reported by Andrew
Tridgell.

Further issues were discovered by Martin Schwenke of the Samba team
while fixing the above issues and auditing other code paths.

Patches provided by Martin Schwenke of the Samba team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================

Updates

2026-07-28 22:35 CEST

Metadata changes:

  • Status for package samba: “Plausible”

2026-07-28 22:27 CEST

Metadata changes:

  • Status for package samba: “New”