---
title: "CVE-2022-2127\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2022-2127?format=md
keywords: index, follow
---

# CVE-2022-2127

Publication date 19 July 2023

Last updated 18 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.9 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2022-2127?format=md#impact-score)

Toggle side navigation

## Description

An out-of-bounds read vulnerability was found in Samba due to insufficient
length checks in winbindd\_pam\_auth\_crap.c. When performing NTLM
authentication, the client replies to cryptographic challenges back to the
server. These replies have variable lengths, and Winbind fails to check the
lan manager response length. When Winbind is used for NTLM authentication,
a maliciously crafted request can trigger an out-of-bounds read in Winbind,
possibly resulting in a crash.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| samba | 26.04 LTS resolute | Fixed 2:4.18.5+dfsg-1ubuntu1 |
| 25.10 questing | Fixed 2:4.18.5+dfsg-1ubuntu1 |
| 25.04 plucky | Fixed 2:4.18.5+dfsg-1ubuntu1 |
| 24.10 oracular | Fixed 2:4.18.5+dfsg-1ubuntu1 |
| 24.04 LTS noble | Fixed 2:4.18.5+dfsg-1ubuntu1 |
| 23.10 mantic | Fixed 2:4.18.5+dfsg-1ubuntu1 |
| 23.04 lunar | Fixed 2:4.17.7+dfsg-1ubuntu1.1 |
| 22.10 kinetic | Fixed 2:4.16.8+dfsg-0ubuntu1.2 |
| 22.04 LTS jammy | Fixed 2:4.15.13+dfsg-0ubuntu1.2 |
| 20.04 LTS focal | Fixed 2:4.15.13+dfsg-0ubuntu0.20.04.3 |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |
| 14.04 LTS trusty | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.9 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | High |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.9 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2127)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-2127)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-2127)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2022-2127)

### Related Ubuntu Security Notices (USN)

+ [USN-6238-1](https://usn.ubuntu.com/USN-6238-1)
+ Samba vulnerabilities
+ 19 July 2023

### Other references

* <https://www.samba.org/samba/security/CVE-2022-2127.html>
* <https://www.cve.org/CVERecord?id=CVE-2022-2127>