Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-20254

Date: May 5, 2021

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

Language: C++

Severity Score

Related Resources (16)

https://www.samba.org/samba/security/CVE-2021-20254.html
https://security-tracker.debian.org/tracker/CVE-2021-20254
https://nvd.nist.gov/vuln/detail/CVE-2021-20254
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZAF6L2M6CNAJ2YYYGXPWETTW5YLCWTVT/
https://security.gentoo.org/glsa/202105-22
https://access.redhat.com/security/cve/CVE-2021-20254
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZAF6L2M6CNAJ2YYYGXPWETTW5YLCWTVT/
https://security.netapp.com/advisory/ntap-20210430-0001/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EP2VJ73OVBPVSOSTVOMGIEQA3MWF6F7/
https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
https://people.canonical.com/~ubuntu-security/cve/CVE-2021-20254
https://security.alpinelinux.org/vuln/CVE-2021-20254
https://bugzilla.redhat.com/show_bug.cgi?id=1949442
https://github.com/samba-team/samba/commit/75ad84167f5d2379557ec078d17c9a1c244402fc#diff-ef29a0410140dbac26c7dcb1f7d1709f0ae8ab9073f33fd250564880ad5de2de
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EP2VJ73OVBPVSOSTVOMGIEQA3MWF6F7/
https://www.mend.io/vulnerability-database/CVE-2021-20254

Severity Score

Weakness Type (CWE)

Out-of-bounds Read

CWE-125

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us