Vulnerability · Published Aug 23, 2022 · Assigned by redhat
CVE-2021-20316
Medium 6.8
In plain English
A medium-severity race condition in samba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.8Medium
Exploit odds (30 days)1.0%top 35.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ctdb | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | libsmbclient | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | libsmbclient-devel | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | libwbclient | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | libwbclient-devel | 4.15.5-8.el8_6 | ALSA-2022:2074 |
| AlmaLinux:8 | libwbclient-devel | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | python3-samba | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | python3-samba-test | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-client | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-client-libs | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-common | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-common-libs | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-common-tools | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-devel | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-krb5-printing | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-libs | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-pidl | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-test | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-test-libs | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-vfs-iouring | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-winbind | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-winbind-clients | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-winbind-krb5-locator | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-winbind-modules | 4.15.5-5.el8 | ALSA-2022:2074 |
| AlmaLinux:8 | samba-winexe | 4.15.5-5.el8 | ALSA-2022:2074 |
| Debian:12 | samba | 2:4.16.0+dfsg-2 | DEBIAN-CVE-2021-20316 |
| Debian:13 | samba | 2:4.16.0+dfsg-2 | DEBIAN-CVE-2021-20316 |
| Debian:14 | samba | 2:4.16.0+dfsg-2 | DEBIAN-CVE-2021-20316 |
| Rocky Linux:8 | samba | 0:4.15.5-5.el8 | RLSA-2022:2074 |
| Ubuntu:22.04:LTS | samba | no fix listed | UBUNTU-CVE-2021-20316 |
Affected products (as reported)
Weakness: CWE-362