ALBA-2021:3050 samba bug fix and enhancement update
A memory leak in the Samba RPC server can cause excessive memory allocation, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is ALBA-2021:3050?
ALBA-2021:3050 is a denial of service vulnerability in libsmbclient-devel, published on 10 Aug 2021. It can be exploited over the network, with no action from the victim.
Official description
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.
Bug Fix(es) and Enhancement(s):
/sbin/ldconfig: /lib64/libsmbldap.so.2 is not a symbolic link (BZ#1964314)
smbd tries to delete files with wrong permissions (uses guest instead of user from force user) (BZ#1964398)
Memory leak in RPC server could allocate a lot of memory for print servers (BZ#1969831)
Which versions are affected by ALBA-2021:3050?
Linux distribution packages (3)
libsmbclient-devel AlmaLinux:8 | All versions | 4.13.3-4.el8_4 |
libwbclient-devel AlmaLinux:8 | All versions | 4.13.3-4.el8_4 |
samba-devel AlmaLinux:8 | All versions | 4.13.3-4.el8_4 |
How do I fix ALBA-2021:3050?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is ALBA-2021:3050 being exploited?
There is no known exploitation of ALBA-2021:3050 in the wild and no public exploit code.