Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-20254

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

Published

2021-05-05T14:15:07.883

Last Modified

2024-11-21T05:46:13.203

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

6.8

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-125
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application samba samba < 4.12.15 Yes
Application samba samba < 4.13.8 Yes
Application samba samba < 4.14.4 Yes
Operating System fedoraproject fedora 32 Yes
Operating System fedoraproject fedora 33 Yes
Operating System redhat enterprise_linux 7.0 Yes
Operating System redhat enterprise_linux 8.0 Yes
Operating System debian debian_linux 9.0 Yes
References