Complete
Details
Details
Assignee
Andrew Walker
Andrew WalkerReporter
Andrew Walker
Andrew WalkerLabels
Impact
Critical
Components
Fix versions
Affects versions
Priority
More fields
More fields
Katalon Platform
Katalon Platform
Created January 25, 2022 at 1:33 PM
Updated July 1, 2022 at 5:55 PM
Resolved January 31, 2022 at 6:42 PM
Update Samba version for CVE-2022-44142 (out-of-bounds heap read write vulnerability).
Our default configuration is not impacted by the CVE, but cases where users have opted to share same paths via AFP and SMB simultaneously are impacted.
Issue is resolved by upgrading to Samba version 4.13.17 (TrueNAS 12) and 4.15.5 (TrueNAS 13, TrueNAS SCALE). This correspondes with TrueNAS 12.0-U8, the next TrueNAS 13 nightly, and the next SCALE nightly or SCALE release.
Samba version may be viewed by running the command 'smbd -V' in the shell. For earlier versions of samba, the output of `testparm -s` may be reviewed for the parameters:
> "fruit:metadata=netatalk" or "fruit:resource=file"
The presence of these parameters combined with an affected TrueNAS version mean that the server is affected by the vulnerability and must be updated.
These parameters are added when SMB and AFP shares are configured such that they export the same path (only impacts that specific SMB share), or when the "Mixed-protocol AFP / SMB" preset is selected.
Description from CVE notification:
All versions of Samba prior to 4.13.17 are vulnerable to an
out-of-bounds heap read write vulnerability that allows remote
attackers to execute arbitrary code as root on affected Samba
installations that use the VFS module vfs_fruit.
The specific flaw exists within the parsing of EA metadata when
opening files in smbd. Access as a user that has write access to a
file's extended attributes is required to exploit this
vulnerability. Note that this could be a guest or unauthenticated user
if such users are allowed write access to file extended attributes.
The problem in vfs_fruit exists in the default configuration of the
fruit VFS module using fruit:metadata=netatalk or fruit:resource=file.
If both options are set to different settings than the default values,
the system is not affected by the security issue.
https://www.samba.org/samba/security/CVE-2021-44142.html