Bug 2009676 (CVE-2021-43566) - CVE-2021-43566 samba: Symlink race error can allow directory creation outside of the exported share
Summary: CVE-2021-43566 samba: Symlink race error can allow directory creation outside...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-43566
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2046218 2039157 2044255
Blocks: 2009675
TreeView+ depends on / blocked
 
Reported: 2021-10-01 09:22 UTC by Huzaifa S. Sidhpurwala
Modified: 2022-05-12 02:46 UTC (History)
18 users (show)

Fixed In Version: samba 4.13.16
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-05-12 02:46:09 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Samba Project 13979 0 None None None 2022-01-28 15:22:40 UTC

Description Huzaifa S. Sidhpurwala 2021-10-01 09:22:08 UTC
As per upstream report:

All versions of Samba prior to 4.13.13 are vulnerable to a malicious client using an SMB1 or NFS symlink race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

Clients that have write access to the exported part of the file system under a share via SMB1 unix extensions or NFS can create symlinks that can race the server by renaming an existing path and then replacing it with a symlink. If the client wins the race it can cause the server to create a directory under the new symlink target after the exported share path check has been done. This new symlink target can point to anywhere on the server file system. The authenticated user must have permissions to create a directory under the target directory of the symlink.

Comment 11 Andreas Schneider 2022-05-05 17:15:09 UTC
Samba 4.14 is not affected, as parts of the VFS code have already been rewritten in Samba 4.14. The VFS rewrite was completed in Samba 4.15. This is why CVE-2021-43566 only affects Samba versions < 4.13.16.

Details:
https://www.samba.org/samba/security/CVE-2021-43566.html

Comment 13 Product Security DevOps Team 2022-05-12 02:46:07 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-43566


Note You need to log in before you can comment on or make changes to this bug.