Bug 2009673 (CVE-2021-20316) - CVE-2021-20316 samba: Symlink race error can allow metadata read and modify outside of the exported share
Summary: CVE-2021-20316 samba: Symlink race error can allow metadata read and modify o...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20316
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2039034 2039153 2039154 2046269
Blocks: 2009675
TreeView+ depends on / blocked
 
Reported: 2021-10-01 09:13 UTC by Huzaifa S. Sidhpurwala
Modified: 2022-05-17 09:59 UTC (History)
17 users (show)

Fixed In Version: samba 4.15.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
Clone Of:
Environment:
Last Closed: 2022-05-12 02:45:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:1756 0 None None None 2022-05-10 04:16:01 UTC
Red Hat Product Errata RHSA-2022:2074 0 None None None 2022-05-10 15:15:31 UTC

Description Huzaifa S. Sidhpurwala 2021-10-01 09:13:41 UTC 
As per upstream report: 

All versions of Samba prior to 4.15.0 are vulnerable to a malicious client using an SMB1 or NFS symlink race to allow filesystem metadata to be accessed in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

Clients that have write access to the exported part of the file system under a share via SMB1 unix extensions or NFS can create symlinks that can race the server by renaming an existing path and then replacing it with a symlink. If the client wins the race it can cause the server to read or modify file or directory metadata on the symlink target.

The authenticated user must have permissions to read or modify the metadata of the target of the symlink in order to perform the operation outside of the share.

Filesystem metadata includes such attributes as timestamps, extended attributes, permissions, and ownership.
Comment 1 Huzaifa S. Sidhpurwala 2021-10-04 03:29:39 UTC 
Upstream bug (currently private):

https://bugzilla.samba.org/show_bug.cgi?id=14842
Comment 2 Guilherme de Almeida Suckevicz 2022-01-10 18:47:34 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2039034]
Comment 5 Tomas Hoger 2022-05-06 09:21:33 UTC 
Upstream advisory:
https://www.samba.org/samba/security/CVE-2021-20316.html
Comment 6 errata-xmlrpc 2022-05-10 04:15:59 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 8

Via RHSA-2022:1756 https://access.redhat.com/errata/RHSA-2022:1756
Comment 7 errata-xmlrpc 2022-05-10 15:15:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:2074 https://access.redhat.com/errata/RHSA-2022:2074
Comment 8 Product Security DevOps Team 2022-05-12 02:45:14 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20316
Note You need to log in before you can comment on or make changes to this bug.