PT-2021-13840 · Unknown+4 · Cifs-Utils+4

Aurélien Aptel · Published 2021-04-13 · Updated 2025-08-07 · CVE-2021-20208

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: cifs-utils versions prior to 6.13

Description: A flaw was found in cifs-utils where a user mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Recommendations: For versions prior to 6.13, update to version 6.13 or later to resolve the issue. As a temporary workaround, consider restricting access to Kerberos credentials or limiting the ability to mount krb5 CIFS file systems from within containers until a patch is applied.

Fix

Incorrect Privilege Assignment

Improper Privilege Management

Weakness Enumeration

CWE-266

CWE-269

Related Identifiers

ALT-PU-2021-2082

ALT-PU-2021-2774

ALT-PU-2021-2827

ALT-PU-2022-2563

AZL-6354

CVE-2021-20208

MGASA-2021-0277

OESA-2021-1193

OPENSUSE-SU-2021:0639-1

OPENSUSE-SU-2021_0639-1

OPENSUSE-SU-2024:10683-1

SUSE-SU-2021:1159-1

SUSE-SU-2021:1161-1

SUSE-SU-2021:1455-1

SUSE-SU-2021_1159-1

SUSE-SU-2021_1161-1

USN-5459-1

USN-7688-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Cifs-Utils

References · 61

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WJ3SVBHCSNQZAWSGLB6FBOCFU45FFG · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1161-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20208 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0639-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20208 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1193 · Vendor Advisory
• https://bugzilla.samba.org/show_bug.cgi?id=14651 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0277.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20208 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20208 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4HSDIWXXNQBUW5ZS37RQMLJ7THK5AS · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5459-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6354 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5459-1 · Vendor Advisory