CVE-2021-23192: Input Validation
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
Other sources
As per upstream advisory:
Samba implements DCE/RPC, and in most cases it is provided over and protected by the underlying SMB transport, with protections like 'SMB signing'.
However there are other cases where large DCE/RPC request payloads are exchanged and fragmented into several pieces. If this happens over untrusted transports (e.g. directly over TCP/IP or anonymous SMB) clients will typically protect by an explicit authentication at the DCE/RPC layer, e.g. with GSSAPI/Kerberos/NTLMSSP or Netlogn Secure Channel.
Because the checks on the fragment protection were not done between the policy controls on the header and the subsequent fragments, an attacker could replace subsequent fragments in requests with their own data, which might be able to alter the server behaviour.
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-23192?
CVE-2021-23192 is a vulnerability found in the way Samba implemented DCE/RPC, allowing an attacker to bypass signature requirements.
What is the severity of CVE-2021-23192?
The severity of CVE-2021-23192 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2021-23192?
Samba versions up to 4.15.2, 4.14.10, and 4.13.14 are affected by CVE-2021-23192.
How can an attacker exploit CVE-2021-23192?
An attacker can exploit CVE-2021-23192 by sending a large DCE/RPC request to a Samba server and replacing later fragments with their own data.
Where can I find more information about CVE-2021-23192?
You can find more information about CVE-2021-23192 on the Red Hat Bugzilla and Red Hat Security websites.