GSD-2021-44142 Remote code execution as root in Samba prior to version 4.13.17
Remote attackers can execute arbitrary code as root on Samba servers using the vfs_fruit module with default metadata settings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GSD-2021-44142?
GSD-2021-44142 is a memory corruption vulnerability, published on 1 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
To quote the Samba advisory:
All versions of Samba prior to 4.13.17 are vulnerable to an out-of-bounds heap read write vulnerability that allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit.
The specific flaw exists within the parsing of EA metadata when opening files in smbd. Access as a user that has write access to a file's extended attributes is required to exploit this vulnerability. Note that this could be a guest or unauthenticated user if such users are allowed write access to file extended attributes.
The problem in vfs_fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file. If both options are set to different settings than the default values, the system is not affected by the security issue.
Which versions are affected by GSD-2021-44142?
How do I fix GSD-2021-44142?
No fix has been published for GSD-2021-44142 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GSD-2021-44142 being exploited?
There is no known exploitation of GSD-2021-44142 in the wild and no public exploit code.