===========================================================
== Subject: The CTDB protocol has bounds checking issues
==
== CVE ID#: CVE-2026-58224
==
== Versions: All versions since 4.2
==
== Summary: CTDB fails to do integrity checking of received
packets. This includes failure to check field lengths
against packet lengths when unmarshalling packets.
===========================================================
===========
Description
===========
CTDB fails to do a number of integrity checks on received packets.
This includes:
* checking of field lengths against packet lengths when unmarshalling
packets;
* edge-case checking of string NUL-termination; and
* sanity checking of overall packet lengths.
This can result in denial of service (DoS) (due to crash or out-of
memory) and possible limited disclosure of adjacent memory
allocations.
Most of the issues are in the protocol handling for the CTDB private
network. Some are in handling of the CTDB event protocol, used on a
local Unix domain socket.
The impact is mitigated by documented protections that should be in
place on the CTDB private network:
It is strongly recommended that the private addresses are configured
on a private network that is separate from client networks. This is
because the CTDB protocol is both unauthenticated and unencrypted.
[...]
Overall sanity checking of packet lengths to avoid out-of-memory DoS
is not being addressed. No size limit is currently placed on packets
sent by CTDB, so implementing an arbitrary restriction on the size of
received packets could result in the rejection of valid packets.
Part of the solution to all of these issues is strengthening the
documentation about securing the private network.
================== Patch Availability ==================
Patches addressing this issue have been posted to:
https://www.samba.org/samba/security/
Additionally, Samba 4.24.5, 4.23.11, 4.22.10 have been issued as
security releases to correct the defect. Samba administrators are
advised to upgrade to these releases or apply the patch as soon as
possible.
==================
CVSSv3 calculation
==================
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H 7.1
==========
Workaround
==========
Secure the CTDB private network, as documented.
=======
Credits
=======
The top-level CTDB protocol issues were originally reported by Tristan
Madani of Talence Security.
Out-of-memory DoS issues, along with issues in the event protocol and
the control part of the main protocol were reported by Andrew
Tridgell.
Further issues were discovered by Martin Schwenke of the Samba team
while fixing the above issues and auditing other code paths.
Patches provided by Martin Schwenke of the Samba team.
==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================