Samba

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. Samba sits in Tier 2, which caps at $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Memory-safety hardening can carry a 2× or 3× multiplier. Patches must be between one and twelve months old, submissions are rate-limited to three a month, and sanctions and territory exclusions apply. CVE history 5 Last 12 months 215 Lifetime Memory safety 30 % Access control 30 % Auth bypass 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Samba is how Linux, BSD, macOS and effectively every NAS appliance on earth speak SMB, and it is the Active Directory domain controller for a large share of the organisations that left Windows Server. It is the file-sharing layer inside Synology, QNAP, TrueNAS, OpenMediaVault, Western Digital and Netgear firmware, and inside printers, cameras and industrial controllers that will never be updated. A pre-authentication bug in smbd is a wormable, LAN-wide event, and 215 lifetime CVEs is what three decades of continuous adversarial attention against that surface looks like. The Samba Team pays nothing for a report, and [email protected] is a working unpaid channel, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The Samba Team takes reports at [email protected] and runs a long-standing coordinated process over upstream Samba. The lines it draws are other vendors' code and libraries with their own scope rows, so the Samba tree itself is what a researcher works against The file server in full: the SMB1, SMB2 and SMB3 protocol implementation in smbd , reachable pre-authentication on TCP/445 from any host that can route to the machine The Active Directory domain controller in full: LDAP, the Kerberos KDC, DRSUAPI replication, the DsCrackNames family and the directory backend underneath them winbindd and the NSS and PAM integration boundary, where a string controlled by the domain crosses into a local privileged process The VFS module set as a whole, vfs_fruit for macOS interoperability included, covering path handling and extended-attribute processing The RPC layer generated from IDL and the ndr marshalling code underneath it, which decodes attacker-supplied wire structures for every service built on the generated stubs Samba's own client side, which parses whatever a server sends back; the exclusion below is for Windows-side defects reached through it rather than for the client code itself ctdb clustering and the state it shares between nodes, where a code defect rather than an operational preference is at issue Out of scope Configuration mistakes rather than code defects: world-writable shares, map to guest = bad user , signing turned off Windows-side or Microsoft Active Directory bugs reached through Samba's client rather than defects in Samba itself ctdb clustering behaviour that is correct but operationally undesirable Bugs that actually live in a linked library with its own scope row, such as OpenLDAP, MIT krb5 or GnuTLS One-line fixes for non-exploitable crashes, which the reward panel excludes Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail Most-valued findings Pre-authentication memory corruption in smbd reachable on TCP/445 before any credential is checked. That is the wormable shape, and the one that combines Samba's two largest bug classes Authentication or authorization bypass in the AD DC path: Kerberos, LDAP or DRSUAPI handling that grants a session or a replication right it should not. This is the area that produced the Zerologon-adjacent and BadSamba classes Privilege escalation across the winbindd boundary, where a domain-controlled name or SID reaches a local process running as root Path handling and extended-attribute defects in VFS modules such as vfs_fruit , historically a rich source of both, that let a share client read or write outside the exported tree Memory-safety flaws in the ndr marshalling layer driven purely by attacker-supplied RPC structures, which reach every service built on the generated stubs Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The cash on Google's rail is paid for a merged upstream patch. A vulnerability report on its own earns nothing there Samba review lands through git.samba.org rather than GitHub and is unusually strict, so the merge precondition is materially harder here than on most projects Keep the patch merged, without reverts, for one month before claiming the reward Patches must be at least one month and no more than twelve months old, and submissions are capped at three per person per month Google cannot pay individuals or entities on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure Coordinated with the Samba Team through [email protected] . Samba runs a long-standing coordinated process, batching fixes into scheduled security releases with per-CVE advisory detail and researcher credit; hold the write-up until that advisory is published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability