CVE-2021-20254

2021-05-0513:36:32

CWE-125

redhat

www.cve.org

7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.4%

JSON

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

CNA Affected

[
  {
    "product": "samba",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "samba 4.14.1, samba 4.13.6, samba 4.12.13"
      }
    ]
  }
]