CVE-2021-44141: Infoleak
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
Other sources
As per samba upstream advisory:
All versions of Samba prior to 4.15.4 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
Clients that have write access to the exported part of the file system under a share via SMB1 unix extensions or via NFS can create symlinks that point to arbitrary files or directories on the server filesystem.
Clients can then use SMB1 unix extension information queries to determine if the target of the symlink exists or not by examining error codes returned from the smbd server. There is no ability to access these files or directories, only to determine if they exist or not.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-44141?
CVE-2021-44141 is a vulnerability in Samba that allows a malicious client to determine if a file or directory exists in the server file system.
How does CVE-2021-44141 work?
CVE-2021-44141 works by using a server symlink to check if a file or directory exists in an area of the server file system not exported under the share definition.
Which versions of Samba are affected by CVE-2021-44141?
All versions of Samba prior to 4.15.5 are affected by CVE-2021-44141.
What is the severity of CVE-2021-44141?
The severity of CVE-2021-44141 is medium, with a severity score of 4.3.
How can I fix CVE-2021-44141?
To fix CVE-2021-44141, update your Samba software to version 4.15.5 or later.