cve/2018/CVE-2018-16841.md

### [CVE-2018-16841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16841)
![](https://img.shields.io/static/v1?label=Product&message=samba&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brighgreen)

### Description

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.

### POC

#### Reference
- https://usn.ubuntu.com/3827-2/

#### Github
No PoCs found on GitHub currently.