Trend Micro -
An earlier version of an out-of-bounds (OOB) vulnerability in Samba was disclosed via Trend Micro Zero Day Initiative’s (ZDI) Pwn2Own Austin 2021. ZDI looked further into the security gap and found more variants of the vulnerability after the event and subsequently disclosed the findings to the company. While we have not seen any active attacks exploiting this vulnerability, CVE-2021-44142 received a CVSS rating of 9.9 out of the three variants reported. If abused, this security gap can be used by remote attackers to execute arbitrary code as root on all affected installations that use the virtual file system (VFS) module vfs_fruit. Samba has released all the relevant patches to mitigate the impact of the threats that can abuse this gap. Trend Micro customers are protected and can follow manual workarounds to address this issue.
What is Samba?Samba is a standard interoperability software suite integrated in Windows, a reimplementation of the server message block (SMB) networking protocol for file and print services. It runs on most Unix and Unix-like systems such as Linux and macOS systems, among other versions and operating systems (OS) that use the SMB/Common Internet File System (CIFS) protocol. This allows network administrators to configure, integrate, and set