Published: 19/04/2021 Updated: 07/11/2023

CVSS v2 Base Score: 4.9 | Impact Score: 4.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 6.1 | Impact Score: 4.7 | Exploitability Score: 0.8

VMScore: 436

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

A flaw was found in cifs-utils in versions prior to 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba cifs-utils
redhat enterprise linux 7.0
redhat enterprise linux 8.0
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35

Debian Bug report logs - #987308 cifs-utils: CVE-2021-20208: cifsupcall kerberos auth leak in container Package: src:cifs-utils; Maintainer for src:cifs-utils is Debian Samba Maintainers <pkg-samba-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 21 Apr 2021 11:33:02 UT ...

Several security issues were fixed in cifs-utils ...

A flaw was found in cifs-utils A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host The highest threat from this vulnerability is to data confidentiality and integrity ...

A security issue was found in cifs-utils in versions before 613 When a container process causes an operation that trigger the kernel to ask a userspace for user credentials for an SMB filesystem, cifsupcall utility may indirectly leak an information about Kerberos credentials available in the host environment and cause non-sanctioned SMB filesys ...

CWE-269 https://bugzilla.samba.org/show_bug.cgi?id=14651 https://bugzilla.redhat.com/show_bug.cgi?id=1921116 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4BZSJXROEFHYATAAHHRR6P3HUSMPQB3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4HSDIWXXNQBUW5ZS37RQMLJ7THK5AS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WJ3SVBHCSNQZAWSGLB6FBOCFU45FFG/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987308 https://ubuntu.com/security/notices/USN-5459-1 https://nvd.nist.gov

CVE-2021-20208

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect