Description
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.5.6+dfsg-1 | — |
| Debian 13 | samba | 2:4.5.6+dfsg-1 | — |
| Debian 12 | samba | 2:4.5.6+dfsg-1 | — |
| Debian 8 | samba | 2:4.2.14+dfsg-0+deb8u12 | DLA-1754-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.8 | USN-3348-1 |
| Ubuntu 14.04 LTS | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.9 | USN-3348-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | ctdb +25 | 4.6.2-8.el7 | RHSA-2017:1950 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | ctdb +25 | 4.6.3-4.el7rhgs | RHSA-2017:2778, RHSA-2017:2338 |
| Red Hat Gluster Storage 3 | libtdb +3 | 1.3.12-1.1.el6rhs | RHSA-2017:2778 |
| Red Hat Gluster Storage 3 | libtevent +2 | 0.9.31-1.el6rhs | RHSA-2017:2778 |
| Red Hat Gluster Storage 3 | pyldb +4 | 1.1.29-1.el6rhs | RHSA-2017:2778 |
| Red Hat Gluster Storage 3 | pytalloc +3 | 2.1.9-1.el6rhs | RHSA-2017:2778 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | samba +23 | 4.6.2-8.el7 | ELSA-2017-1950 |
Advisories 6
- RHSA-2017:2778 Red Hat Security Advisory: samba security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2017:2338 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2017:1950 Red Hat Security Advisory: samba security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-3348-1 samba vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-1754-1 samba - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2017-1950 Low: samba security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 7, 2017
References
- 99455 vdb-entry
- RHSA-2017:2778 vendor-advisory
- RHSA-2017:1950 vendor-advisory
- RHSA-2017:2338 vendor-advisory
- https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=10c3e3923022485c720f322ca4f0aca5d7501310
- https://bugzilla.samba.org/show_bug.cgi?id=12572
- https://bugs.debian.org/864291
- [debian-lts-announce] 20190409 [SECURITY] [DLA 1754-1] samba security update mailing-list