CVE-2021-44142 Memory corruption in Samba

High 8.8 Published 21 Feb 2022 Updated 23 Apr 2025

Remote attackers with write access to extended file attributes can execute arbitrary code as root via heap corruption in the Samba vfs_fruit module.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-44142?

CVE-2021-44142 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 21 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

Weakness: CWE-787, CWE-125

Which versions are affected by CVE-2021-44142?

It affects 23 products.

Linux distribution packages (40)

`libsmbclient` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`libsmbclient-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`libwbclient` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`libwbclient-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-client` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-client-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-common` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-common-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-common-tools` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-dc` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-dc-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-krb5-printing` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-pidl` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-python` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-python-test` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-test` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-test-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-vfs-glusterfs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-winbind` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-winbind-clients` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-winbind-krb5-locator` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`samba-winbind-modules` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-18.el7_9`
`libsmbclient-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`libwbclient-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-dc` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-dc-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-krb5-printing` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-pidl` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-python` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-python-test` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-test` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-test-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`
`samba-vfs-glusterfs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-18.el7_9`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Redhat Codeready Linux Builder, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop and 17 more.

How do I fix CVE-2021-44142?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-44142 being exploited?

There is no known exploitation of CVE-2021-44142 in the wild and no public exploit code.

Public exploit code: 4 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2021-44142, AZL-37008, AZL-8611, CLSA-2022-1643914257, CLSA-2022-1643917481, CLSA-2022-1644501113 and 23 more.