CVE-2022-0336

FAUCET Score

CVE-2022-0336 is a high-severity vulnerability affecting Samba AD DC, specifically impacting Fedora and Samba products. It allows an attacker with write privileges to an account to bypass SPN checks, leading to a denial-of-service by adding duplicate SPNs. Furthermore, an attacker can intercept traffic to impersonate existing services, compromising confidentiality and integrity. With a CVSS score of 8.8, this vulnerability has a network attack vector and low attack complexity, posing a significant risk. While there is no known active exploitation, exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion, indicating awareness.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 4.0.0, < 4.13.17CPE matchmatch criteria	cpe:2.3:a:samba:samba::::::::
		>= 4.14.0, < 4.14.12CPE matchmatch criteria	cpe:2.3:a:samba:samba::::::::
		>= 4.15.0, < 4.15.4CPE matchmatch criteria	cpe:2.3:a:samba:samba::::::::
		34CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:34:::::::*
		35CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:35:::::::*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.30%

Probability of exploitation in next 30 days

EPSS Percentile

67.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0130 is in the 65th percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

github_advisorypatch availablevia nvd_reference

View patch

microsoftpatch availablevia msrc

Product: 16864-17084Fixed in: 4.18.3-1

microsoftpatch availablevia msrc

Product: azl3 samba 4.18.3-1 on Azure Linux 3.0Fixed in: 4.18.3-1

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 x64Fixed in: 4.18.3-1

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 ARMFixed in: 4.18.3-1

Vendor Advisories (3)

microsoft2024-Oct/CVE-2022-0336

CVE-2022-0336

Oct 8, 2024

microsoft2022-Aug/CVE-2022-0336Important

The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally an attacker who can intercept traffic can impersonate existing services resulting in a loss of confidentiality and integrity.

Aug 9, 2022

redhatCVE-2022-0336Important

samba: Samba AD users with permission to write to an account can impersonate arbitrary services

Jan 31, 2022

References

access.redhat.com / security/cve/CVE-2022-0336

Issue TrackingThird Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party Advisory

bugzilla.samba.org / show_bug.cgi

Issue TrackingPatchVendor Advisory

github.com / samba-team/samba/commit/1a5dc817c0c9379bbaab14c676681b42b0039a3c

PatchThird Party Advisory

github.com / samba-team/samba/commit/c58ede44f382bd0125f761f0479c8d48156be400

PatchThird Party Advisory

security.gentoo.org / glsa/202309-06

samba.org / samba/security/CVE-2022-0336.html

Vendor Advisory