Read the docs
TI-2021-03605 Aliases CVE-2021-20316GHSA-88fw-cm3w-8cq5

Race condition in samba

Priority LOW 32CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.

Why it matters now

EPSS 0.01042 64th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—sambaAffects samba file server before v4.15.0, Fixed in samba v4.15.0—No fix listedCNA
  • samba Vendor— Affected Affects samba file server before v4.15.0, Fixed in samba v4.15.0 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*before 4.15.0VulnerableSamba
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
  • cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* Versions before 4.15.0 Vulnerable ·Samba
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2022:2074 Released 2022-05-10 · Red Hat rating Moderate
    samba security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring-4.15.5-5.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) ctdb-4.15.5-5.el8, libsmbclient-4.15.5-5.el8, libwbclient-4.15.5-5.el8 +18
    • Red Hat Enterprise Linux CRB (v. 8) libsmbclient-devel-4.15.5-5.el8, libwbclient-devel-4.15.5-5.el8, samba-devel-4.15.5-5.el8
  • RHSA-2022:1756 Released 2022-05-10 · Red Hat rating Moderate
    samba security, bug fix and enhancement update
    • Red Hat Gluster 3.5 Samba on RHEL-8 ctdb-4.15.5-100.el8rhgs, libsmbclient-4.15.5-100.el8rhgs, libsmbclient-devel-4.15.5-100.el8rhgs +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:2074
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2022:2074
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2022:2074
Red Hat Gluster 3.5 Samba on RHEL-8Fixed RHSA-2022:1756
Not affected: 2 products
  • Red Hat Enterprise Linux 9
  • Red Hat Gluster 3.5 Samba on RHEL-8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20316
  2. 2026-10-03 Alias added: GHSA-88fw-cm3w-8cq5

References

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences