CVE-2021-20316: Race Condition
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
Other sources
As per upstream report:
All versions of Samba prior to 4.15.0 are vulnerable to a malicious client using an SMB1 or NFS symlink race to allow filesystem metadata to be accessed in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.
Clients that have write access to the exported part of the file system under a share via SMB1 unix extensions or NFS can create symlinks that can race the server by renaming an existing path and then replacing it with a symlink. If the client wins the race it can cause the server to read or modify file or directory metadata on the symlink target.
The authenticated user must have permissions to read or modify the metadata of the target of the symlink in order to perform the operation outside of the share.
Filesystem metadata includes such attributes as timestamps, extended attributes, permissions, and ownership.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-20316?
CVE-2021-20316 is a vulnerability in Samba that allows an authenticated attacker to perform operations outside of a shared directory.
How severe is CVE-2021-20316?
CVE-2021-20316 has a severity score of 6.8, which is considered medium.
Which software is affected by CVE-2021-20316?
Samba versions up to 4.15.0, Debian Linux 10.0 and 11.0, Redhat Virtualization Host 4.0, Redhat Enterprise Linux 8.0, 8.6, and samba package versions up to 2:4.13.13+dfsg-1~deb11u5 are affected by CVE-2021-20316.
How can I fix CVE-2021-20316?
To fix CVE-2021-20316, update to Samba version 4.15.0 or later, Debian Linux 10.0 or 11.0, Redhat Virtualization Host 4.0, or Redhat Enterprise Linux 8.0 or 8.6, and update the samba package to 2:4.17.9+dfsg-0+deb12u3, 2:4.17.10+dfsg-0+deb12u1, or 2:4.19.0+dfsg-1.
Where can I find more information about CVE-2021-20316?
You can find more information about CVE-2021-20316 on the Red Hat Security Advisory and Samba bugzilla pages: https://access.redhat.com/security/cve/CVE-2021-20316, https://bugzilla.redhat.com/show_bug.cgi?id=2009673, https://bugzilla.samba.org/show_bug.cgi?id=14842.