Lucene search

K
nvd[email protected]NVD:CVE-2021-44142
HistoryFeb 21, 2022 - 3:15 p.m.

CVE-2021-44142

2022-02-2115:15:07
CWE-125
CWE-787
web.nvd.nist.gov
9
samba
vfs_fruit module
extended file attributes
out-of-bounds heap read
write access
arbitrary code
smbd privilege escalation

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.18

Percentile

96.2%

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide β€œβ€¦enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.” Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

Affected configurations

Nvd
Node
sambasambaRange<4.13.17
OR
sambasambaRange4.14.0–4.14.12
OR
sambasambaRange4.15.0–4.15.5
Node
debiandebian_linuxMatch10.0
OR
debiandebian_linuxMatch11.0
Node
canonicalubuntu_linuxMatch14.04esm
OR
canonicalubuntu_linuxMatch16.04esm
OR
canonicalubuntu_linuxMatch18.04lts
OR
canonicalubuntu_linuxMatch20.04lts
OR
canonicalubuntu_linuxMatch21.10
Node
synologydiskstation_managerRange6.2–6.2.4-25556.4
Node
fedoraprojectfedoraMatch34
OR
fedoraprojectfedoraMatch35
Node
redhatcodeready_linux_builderMatch-
OR
redhatgluster_storageMatch3.5
OR
redhatvirtualization_hostMatch4.0
OR
redhatenterprise_linuxMatch7.0
OR
redhatenterprise_linuxMatch8.0
OR
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_eusMatch8.2
OR
redhatenterprise_linux_eusMatch8.4
OR
redhatenterprise_linux_for_ibm_z_systemsMatch7.0
OR
redhatenterprise_linux_for_ibm_z_systemsMatch8.0
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch8.2
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch8.4
OR
redhatenterprise_linux_for_power_big_endianMatch7.0
OR
redhatenterprise_linux_for_power_little_endianMatch7.0
OR
redhatenterprise_linux_for_power_little_endianMatch8.0
OR
redhatenterprise_linux_for_power_little_endian_eusMatch8.2
OR
redhatenterprise_linux_for_power_little_endian_eusMatch8.4
OR
redhatenterprise_linux_for_scientific_computingMatch7.0
OR
redhatenterprise_linux_resilient_storageMatch7.0
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_serverMatch8.1
OR
redhatenterprise_linux_server_ausMatch8.2
OR
redhatenterprise_linux_server_ausMatch8.4
OR
redhatenterprise_linux_server_tusMatch8.2
OR
redhatenterprise_linux_server_tusMatch8.4
OR
redhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.1
OR
redhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.2
OR
redhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.4
OR
redhatenterprise_linux_workstationMatch7.0
VendorProductVersionCPE
sambasamba*cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
canonicalubuntu_linux18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
canonicalubuntu_linux20.04cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
canonicalubuntu_linux21.10cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*
synologydiskstation_manager*cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*
fedoraprojectfedora34cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Rows per page:
1-10 of 401

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.18

Percentile

96.2%