CVE-2021-44142

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
redhatCNA
---
---
CVEADP
---
---
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
sambasamba
𝑥
< 4.13.17
sambasamba
4.14.0 ≤
𝑥
< 4.14.12
sambasamba
4.15.0 ≤
𝑥
< 4.15.5
debiandebian_linux
10.0
debiandebian_linux
11.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
20.04
canonicalubuntu_linux
21.10
synologydiskstation_manager
6.2 ≤
𝑥
< 6.2.4-25556.4
redhatcodeready_linux_builder
-
redhatgluster_storage
3.5
redhatvirtualization_host
4.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_eus
8.2
redhatenterprise_linux_eus
8.4
redhatenterprise_linux_for_ibm_z_systems
7.0
redhatenterprise_linux_for_ibm_z_systems
8.0
redhatenterprise_linux_for_ibm_z_systems_eus
8.2
redhatenterprise_linux_for_ibm_z_systems_eus
8.4
redhatenterprise_linux_for_power_big_endian
7.0
redhatenterprise_linux_for_power_little_endian
7.0
redhatenterprise_linux_for_power_little_endian
8.0
redhatenterprise_linux_for_power_little_endian_eus
8.2
redhatenterprise_linux_for_power_little_endian_eus
8.4
redhatenterprise_linux_for_scientific_computing
7.0
redhatenterprise_linux_resilient_storage
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server
8.1
redhatenterprise_linux_server_aus
8.2
redhatenterprise_linux_server_aus
8.4
redhatenterprise_linux_server_tus
8.2
redhatenterprise_linux_server_tus
8.4
redhatenterprise_linux_server_update_services_for_sap_solutions
8.1
redhatenterprise_linux_server_update_services_for_sap_solutions
8.2
redhatenterprise_linux_server_update_services_for_sap_solutions
8.4
redhatenterprise_linux_workstation
7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
samba
bullseye (security)
2:4.13.13+dfsg-1~deb11u6
fixed
bullseye
2:4.13.13+dfsg-1~deb11u6
fixed
bookworm
2:4.17.12+dfsg-0+deb12u1
fixed
bookworm (security)
2:4.17.12+dfsg-0+deb12u1
fixed
sid
2:4.21.1+dfsg-2
fixed
trixie
2:4.21.1+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
samba
jammy
Fixed 4.13.17~dfsg-0ubuntu1
released
impish
Fixed 2:4.13.17~dfsg-0ubuntu0.21.10.1
released
focal
Fixed 2:4.13.17~dfsg-0ubuntu0.21.04.1
released
bionic
Fixed 2:4.7.6+dfsg~ubuntu-0ubuntu2.28
released
xenial
Fixed 2:4.3.11+dfsg-0ubuntu0.16.04.34+esm1
released
trusty
Fixed 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm12
released
Common Weakness Enumeration
References
https://bugzilla.samba.org/show_bug.cgi?id=14914
https://kb.cert.org/vuls/id/119678
https://security.gentoo.org/glsa/202309-06
https://www.samba.org/samba/security/CVE-2021-44142.html
https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin
https://bugzilla.samba.org/show_bug.cgi?id=14914
https://kb.cert.org/vuls/id/119678
https://security.gentoo.org/glsa/202309-06
https://www.kb.cert.org/vuls/id/119678
https://www.samba.org/samba/security/CVE-2021-44142.html
https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin