Samba Memory Disclosure Vulnerability (CVE-2025-9640)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.155662");
  script_version("2025-10-17T05:39:07+0000");
  script_tag(name:"last_modification", value:"2025-10-17 05:39:07 +0000 (Fri, 17 Oct 2025)");
  script_tag(name:"creation_date", value:"2025-10-16 03:30:01 +0000 (Thu, 16 Oct 2025)");
  script_tag(name:"cvss_base", value:"4.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-10-15 13:16:01 +0000 (Wed, 15 Oct 2025)");

  script_cve_id("CVE-2025-9640");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Memory Disclosure Vulnerability (CVE-2025-9640)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba is prone to an uninitialized memory disclosure
  vulnerability via vfs_streams_xattr.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"An authenticated user can read an unlimited number of samples
  of discarded heap memory, due to a failure to initialise memory in streams_xattr_pwrite() in the
  vfs_streams_xattr file server module.

  This is achieved by issuing write requests that creates holes in the file.

  Samba erases known secrets before freeing the associated memory, which somewhat mitigates the
  data leak.");

  script_tag(name:"affected", value:"Samba version 3.2 prior to 4.21.9, 4.22.x prior to 4.22.5 and
  4.23.x prior to 4.23.2.");

  script_tag(name:"solution", value:"Update to version 4.21.9, 4.22.5, 4.23.2 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2025-9640.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.21.9.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.22.5.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.23.2.html");
  script_xref(name:"URL", value:"https://lists.samba.org/archive/samba-announce/2025/000704.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "3.2", test_version_up: "4.21.9")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.21.9", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "4.22.0", test_version_up: "4.22.5")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.22.5", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "4.23.0", test_version_up: "4.23.2")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.23.2", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);