Samba bug may allow code execution as root on Linux machines, NAS devices (CVE-2021-44142)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7494 | Unauthenticated RCE in Samba via malicious shared library upload (SambaCry) CVE-2017-7494, widely known as "SambaCry," is a remote code execution vulnerability (CWE-94, code injection) in Samba versions since 3.5.0, fixed in 4.6.4, 4.5.10, and 4.4.14. A malicious client with write access to a share uploads a shared library to a writable share and then causes the Samba server to load and execute it, giving the attacker code execution on the host with the privileges of the Samba service. Because Samba is bundled with most Linux distributions and with NAS and other embedded devices, both enterprise Linux servers and consumer/small-business NAS appliances are affected; Debian also ships affected Samba packages. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30) with known ransomware use, and public reporting ties it to the SambaCry, CowerSnail, ETERNALSILENCE, and SHELLBIND malware campaigns. EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile). Do: Upgrade Samba to 4.6.4 or later (4.6.x), 4.5.10 or later (4.5.x), or 4.4.14 or later (4.4.x/earlier), or install updated samba packages from your distribution (e.g., Debian) per vendor instructions, as required by the CISA KEV catalog. Until patched, remove or restrict write access on shares reachable by untrusted clients, and audit writable shares for unexpected shared-library (.so) files that may have been planted by attackers. Prioritize internet-facing Samba servers and NAS devices, given confirmed ransomware and IoT/NAS malware exploitation of this flaw. | 9.8 | 99% | KEV ransomware |
| massOn the order of hundreds of thousands of internet-exposed Samba/SMB servers and NAS devices; millions of installations in total | |
| CVE-2021-44142 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Ne The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. NVD description · AI analysis pending | 8.8 | 74% |
| — |
Full article668 words · extracted from helpnetsecurity.com · click to collapse
A critical vulnerability (CVE-2021-44142) in Samba, a widely used open source implementation of the Server Message Block (SMB) networking protocol, could allow attackers to execute arbitrary code as root on affected Samba installations.
Several updated versions of Samba have been released on Monday, fixing CVE-2021-44142 and two other flaws (1, 2), but since the software is included in most Linux and Unix-like operating systems (including Apple’s macOS and macOS Server), users of those are advised to keep an eye out for specific updates by those developer teams.
About CVE-2021-44142
Samba allows file and print sharing between computers running Windows and those running Unix or Linux.
CVE-2021-44142 is an out-of-bounds heap read/write vulnerability in Samba’s vfs_fruit virtual file system (VFS) module.
“The fruit module that ships with Samba is designed to provide interoperability between Samba and Netatalk. Netatalk is an open-source implementation of the Apple Filing Protocol (AFP). It allows Unix-like systems to serve as file servers for Apple devices. The specific flaw exists within the parsing of EA metadata in the Samba server daemon (smbd) when opening a file,” the ZDI Research Team noted, and shared technical details about the flaw and a variant – all of which have been patched in the latest Samba security updates.
According to the Samba Team, the vulnerability can be exploited by any user that has write access to a file’s extended attributes – even a guest or unauthenticated user if they have those permissions.
But not all systems may be affected. “The problem in vfs_fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file. If both options are set to different settings than the default values, the system is not affected by the security issue,” they noted.
CVE-2021-44142 was discovered and its exploitation demonstrated at the Pwn2Own Austin 2021 in November 2021 by Nguyễn Hoàng Thạch and Billy Jheng Bing-Jhong of STAR Labs. It was also independently discovered by Orange Tsai of DEVCORE and reported to the Samba team. The heap-based buffer overflow variant of the bug was discovered and reported by ZDI vulnerability researcher Lucas Leong.
Remediation and risk mitigation
The flaw affects all versions of Samba prior to 4.13.17. The patch has also been included in Samba 4.14.12 and 4.15.5.
The Samba Team has also pointed out a workaround: removing the fruit VFS module from the list of configured VFS objects in any vfs objects line in the Samba configuration smb.conf, but warned that this might cause “all stored information to be inaccessible and will make it appear to macOS clients as if the information is lost.”
For that and other reasons, updating is the best option.
“Administrators are advised to focus on testing and deploying the patch to remediate the vulnerability. ZDI also advises that many different vendors will need to update their version to ship with affected devices (such as NAS devices), so the release of additional patches can be expected,” the ZDI team noted.
CERT/CC lists Red Hat, SUSE Linux and Ubuntu as affected.
“The company’s vendor list shows that the potential sectors affected by this security concern include critical industries such as communications, energy, government, manufacturing, and science and technology, as well as consumer devices such as appliances and internet of things (IoT) devices,” ZDI added.
Though there is no indication that CVE-2021-44142 is being exploited in active attacks, it is not unusual for attackers to exploit Samba vulnerabilities. SambaCry (CVE-2017-7494) has been, for example, used in the past to compromise NAS devices and deliver ransomware.
“Given the standard use of Samba for system interoperability via the SMB protocol, administrators should monitor shared file, printer, and access sharing data transmissions,” the ZDI team advised.
“The Windows SMB, which is used for remote services, can be abused by attackers to propagate through the organization’s network, or used as a jump-off point to spread to other connected systems. Administrators are advised to enable solutions that can monitor and scan for transmissions that require the vfs_fruit configurations.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/02/02/samba-bug-may-allow-code-execution-as-root-on-linux-machines-nas-devices-cve-2021-44142/