CVE-2021-20254: Medium severity samba vulnerability
A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
As per upstream:
The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user.
Most commonly this flaw caused the calling code to crash, but an alert user (Peter Eriksson, IT Department, Linköping University) found this flaw by noticing an unprivileged user was able to delete a file within a network share that they should have been disallowed access to.
Analysis of the code paths has not allowed us to discover a way for a remote user to be able to trigger this flaw reproducibly or on demand, but this CVE has been issued out of an abundance of caution.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-20254?
CVE-2021-20254 is a vulnerability found in Samba that allows the smbd file server to read data beyond the end of the array in the case of a negative cache entry.
What is the severity of CVE-2021-20254?
The severity of CVE-2021-20254 is medium, with a CVSS score of 6.8.
Which software versions are affected by CVE-2021-20254?
Samba versions 3.6.0 to 4.12.15, 4.13.0 to 4.13.8, and 4.14.0 to 4.14.4 are affected by CVE-2021-20254.
How can I fix CVE-2021-20254?
To fix CVE-2021-20254, update Samba to version 4.14.4, 4.13.8, or 4.12.15, depending on the version you are using.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-20254?
The CWE ID for CVE-2021-20254 is 125.