Is CVE-2021-20254 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 2%.

What products does CVE-2021-20254 affect?

Tracked products affected include Samba. Check the version you run to see whether it is affected.

How do I fix CVE-2021-20254?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2021-20254

Q: What is CVE-2021-20254?

CVE-2021-20254 is a medium-severity software vulnerability (Out-of-bounds read) with a CVSS score of 6.8. A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where

MEDIUM severity · CVSS 6.8 · Out-of-bounds read

6.8CVSS MEDIUM

Summary

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products we track (1)

Samba

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2021-20254

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information