Skip to content
Fencer Vulns
medium 6.8

CVE-2021-20316 json

A flaw was found in the way Samba handled file/directory metadata.

published 2022-08-23 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-7741

cvss
6.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.

Patch / fix

  • samba samba 4.15.0
  • samba Debian 14, Debian 13, Debian 12 2:4.16.0+dfsg-2

debian advisories DEBIAN-CVE-2021-20316

  • samba RHEL 8 4.15.5-5.el8
  • ctdb RHEL 8 4.15.5-5.el8
  • samba-libs RHEL 8 4.15.5-5.el8
  • samba-pidl RHEL 8 4.15.5-5.el8
  • samba-test RHEL 8 4.15.5-5.el8
  • libwbclient RHEL 8 4.15.5-5.el8
  • libsmbclient RHEL 8 4.15.5-5.el8
  • samba-client RHEL 8 4.15.5-5.el8

red hat advisories RHSA-2022:2074RHSA-2022:1756

  • samba SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 +1 more 4.15.4+git.324.8332acf1a63-3.54.1
  • sssd SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.16.1-7.28.9
  • gnutls SLES for SAP 12 SP5, SLES 12 SP5 3.4.17-8.4.1
  • p11-kit SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 0.23.2-8.3.2
  • apparmor SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 2.8.2-56.6.3
  • libnettle SLES for SAP 12 SP5, SLES 12 SP5 3.1-21.3.2
  • ca-certificates SLES for SAP 12 SP5, SLES 12 SP5 1_201403302107-15.3.3
  • yast2-samba-client SLES for SAP 12 SP5, SLES 12 SP5 3.1.23-3.3.1

suse advisories SUSE-SU-2022:0323-1SUSE-SU-2022:0283-1

  • samba openSUSE Leap 15.3 4.15.4+git.324.8332acf1a63-150300.3.25.3
  • ldb openSUSE Leap 15.3 2.4.1-150300.3.10.1
  • tdb openSUSE Leap 15.3 1.4.4-150300.3.3.2
  • krb5 openSUSE Leap 15.3 1.19.2-150300.8.3.2
  • sssd openSUSE Leap 15.3 1.16.1-150300.23.17.3
  • talloc openSUSE Leap 15.3 2.3.3-150300.3.3.2
  • tevent openSUSE Leap 15.3 0.11.0-150300.3.3.2
  • apparmor openSUSE Leap 15.3 2.13.6-150300.3.11.2

opensuse advisories openSUSE-SU-2022:0283-1

  • samba AlmaLinux 8 4.15.5-5.el8
  • ctdb AlmaLinux 8 4.15.5-5.el8
  • samba-libs AlmaLinux 8 4.15.5-5.el8
  • samba-pidl AlmaLinux 8 4.15.5-5.el8
  • samba-test AlmaLinux 8 4.15.5-5.el8
  • libwbclient AlmaLinux 8 4.15.5-5.el8
  • libsmbclient AlmaLinux 8 4.15.5-5.el8
  • samba-client AlmaLinux 8 4.15.5-5.el8

almalinux advisories ALSA-2022:2074

  • samba Rocky Linux 8 4.15.5-5.el8

rocky linux advisories RLSA-2022:2074

  • samba Azure Linux 3.0 4.18.3-1

azure linux advisories AZL-37001

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20316 updated cvss 5.9

samba: Symlink race error can allow metadata read and modify outside of the exported share

  • Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 more Red Hat Enterprise Linux 7 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +18 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring 4.15.5-5.el8 Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.15.5-5.el8, samba 4.15.5-5.el8, samba-libs 4.15.5-5.el8, samba-pidl 4.15.5-5.el8, samba-test 4.15.5-5.el8, libwbclient 4.15.5-5.el8, +15 more Red Hat Enterprise Linux CRB (v. 8) samba-devel 4.15.5-5.el8, ctdb-debuginfo 4.15.5-5.el8, samba-debuginfo 4.15.5-5.el8, libwbclient-devel 4.15.5-5.el8, samba-debugsource 4.15.5-5.el8, libsmbclient-devel 4.15.5-5.el8, +17 more
    fixed: vendor fix RHSA-2022:2074
  • Red Hat Gluster 3.5 Samba on RHEL-8 ctdb 4.15.5-100.el8rhgs, samba 4.15.5-100.el8rhgs, samba-libs 4.15.5-100.el8rhgs, samba-pidl 4.15.5-100.el8rhgs, libwbclient 4.15.5-100.el8rhgs, libsmbclient 4.15.5-100.el8rhgs, +12 more
    fixed: vendor fix RHSA-2022:1756
  • Red Hat Enterprise Linux 9 ctdb, samba, libldb, ldb-tools, libnetapi, samba-libs, +27 more Red Hat Gluster 3.5 Samba on RHEL-8 libtdb 1.4.4-2.el8rhgs, libtalloc 2.3.3-2.el8rhgs, tdb-tools 1.4.4-2.el8rhgs, libtevent 0.11.0-1.el8rhgs, python3-tdb 1.4.4-2.el8rhgs, python3-talloc 2.3.3-2.el8rhgs, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

  • n/a samba

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.