CVE-2021-20316: Race Condition
First published: Fri Oct 01 2021(Updated: )
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba Samba | <4.15.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Redhat Virtualization Host | =4.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux Aus | =8.6 | |
| Redhat Enterprise Linux Eus | =8.6 | |
| Redhat Enterprise Linux Tus | =8.6 | |
| redhat/samba | <0:4.15.5-5.el8 | 0:4.15.5-5.el8 |
| redhat/samba | <0:4.15.5-100.el8 | 0:4.15.5-100.el8 |
| redhat/samba | <4.15.0 | 4.15.0 |
| debian/samba | <=2:4.13.13+dfsg-1~deb11u6 | 2:4.17.12+dfsg-0+deb12u1 2:4.21.0~rc1+really4.20.3+dfsg-1 2:4.21.0~rc1+really4.20.4+dfsg-1 |
Remedy
Do not enable SMB1 (please note SMB1 is disabled by default in Samba from version 4.11.0 and onwards). This prevents the creation of symbolic links via SMB1. If SMB1 must be enabled for backward compatibility then add the parameter: unix extensions = no to the [global] section of your smb.conf and restart smbd. This prevents SMB1 clients from creating symlinks on the exported file system. However, if the same region of the file system is also exported using NFS, NFS clients can create symlinks that potentially can also hit the race condition. For non-patched versions of Samba, we recommend only exporting areas of the file system by either SMB2 or NFS, not both.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2021-20316
- https://bugzilla.redhat.com/show_bug.cgi?id=2009673
- https://bugzilla.samba.org/show_bug.cgi?id=14842
- https://security-tracker.debian.org/tracker/CVE-2021-20316
- https://security.gentoo.org/glsa/202309-06
- https://www.samba.org/samba/security/CVE-2021-20316.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2039034
- https://access.redhat.com/errata/RHSA-2022:1756
- https://access.redhat.com/errata/RHSA-2022:2074
- https://access.redhat.com/security/cve/cve-2021-20316
- https://www.cve.org/CVERecord?id=CVE-2021-20316 https://nvd.nist.gov/vuln/detail/CVE-2021-20316 https://www.samba.org/samba/security/CVE-2021-20316.html
Frequently Asked Questions
What is CVE-2021-20316?
CVE-2021-20316 is a vulnerability in Samba that allows an authenticated attacker to perform operations outside of a shared directory.
How severe is CVE-2021-20316?
CVE-2021-20316 has a severity score of 6.8, which is considered medium.
Which software is affected by CVE-2021-20316?
Samba versions up to 4.15.0, Debian Linux 10.0 and 11.0, Redhat Virtualization Host 4.0, Redhat Enterprise Linux 8.0, 8.6, and samba package versions up to 2:4.13.13+dfsg-1~deb11u5 are affected by CVE-2021-20316.
How can I fix CVE-2021-20316?
To fix CVE-2021-20316, update to Samba version 4.15.0 or later, Debian Linux 10.0 or 11.0, Redhat Virtualization Host 4.0, or Redhat Enterprise Linux 8.0 or 8.6, and update the samba package to 2:4.17.9+dfsg-0+deb12u3, 2:4.17.10+dfsg-0+deb12u1, or 2:4.19.0+dfsg-1.
Where can I find more information about CVE-2021-20316?
You can find more information about CVE-2021-20316 on the Red Hat Security Advisory and Samba bugzilla pages: https://access.redhat.com/security/cve/CVE-2021-20316, https://bugzilla.redhat.com/show_bug.cgi?id=2009673, https://bugzilla.samba.org/show_bug.cgi?id=14842.
- collector/nvd-api
- collector/redhat-cve
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/references
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-20316
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/samba
- canonical/samba samba
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- vendor/redhat
- canonical/redhat virtualization host
- version/redhat virtualization host/4.0
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- canonical/redhat enterprise linux aus
- version/redhat enterprise linux aus/8.6
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/8.6
- canonical/redhat enterprise linux tus
- version/redhat enterprise linux tus/8.6
- package-manager/redhat
- package-manager/debian