{"id":"CVE-2021-44142","published":"2022-02-21T14:30:12Z","modified":"2025-04-23T19:02:19Z","title":"The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide \"...enhanced compatibility with Apple…","vendor":"Samba","product":"Samba","tier":"core","eol":null,"affectedVersions":[{"vendor":"Samba","product":"Samba","versions":[">= unspecified, < 4.13.17",">= unspecified, < 4.14.12",">= unspecified, < 4.15.5"]}],"description":{"text":"The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide \"...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.\" Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Samba vfs_fruit module, which uses extended file attributes to support Apple SMB clients and Netatalk 3 AFP interoperability, contains out-of-bounds heap read and write flaws in Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 when vfs_fruit is configured. A remote attacker with write access to extended file attributes can craft them to execute arbitrary code with the privileges of smbd, typically root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:46Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.73589,"percentile":0.99466,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-07-25","exploitedFirstSeen":"2024-07-25","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","date":"2024-07-25"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"NCSC and partners issue warning over North Korean state-sponsored cyber campaign to steal military and nuclear secrets","url":"https://otx.alienvault.com/pulse/66b1ebf1bb045b0a9ac380d8","created":"2024-08-06"},{"name":"Exposing Onyx Sleet: Indictments, TTPs, and Arsenal","url":"https://otx.alienvault.com/pulse/66aa334b7fc91f0b45a50743","created":"2024-07-31"},{"name":"Western Digital Fixes a Critical Bug Affecting My Cloud OS 5 Devices That Lets Hackers Gain RCE with Root Privileges","url":"https://otx.alienvault.com/pulse/624af26f1e07f00c0882a2d8","created":"2022-04-04"},{"name":"MS-ISAC CYBERSECURITY ADVISORY - A Vulnerability in Samba Could Allow for Arbitrary Code Execution - PATCH: NOW","url":"https://otx.alienvault.com/pulse/6227d07ebe5d94fb04f7010f","created":"2022-03-08"},{"name":"Samba Multiple Vulnerabilities","url":"https://otx.alienvault.com/pulse/61fcbb0f13c0a592646f942e","created":"2022-02-04"},{"name":"Samba Releases Software Updates to Address Multiple Security Vulnerabilities","url":"https://otx.alienvault.com/pulse/61fa196f26ed3f73cb7bab90","created":"2022-02-02"}],"provenance":"machine"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://www.samba.org/samba/security/CVE-2021-44142.html","tags":[]},{"url":"https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin","tags":[]},{"url":"https://kb.cert.org/vuls/id/119678","tags":["third-party-advisory"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=14914","tags":[]},{"url":"https://security.gentoo.org/glsa/202309-06","tags":["vendor-advisory"]},{"url":"https://www.kb.cert.org/vuls/id/119678","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-30995","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-30995","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":1,"earliest":"2022-03-29","earliestUrl":"https://github.com/horizon3ai/CVE-2021-44142","repos":[{"name":"horizon3ai/CVE-2021-44142","url":"https://github.com/horizon3ai/CVE-2021-44142","stars":10,"created":"2022-03-29"},{"name":"Nxvh1337/CVE-2021-44142-vulnerable-lab","url":"https://github.com/Nxvh1337/CVE-2021-44142-vulnerable-lab","stars":3,"created":"2025-10-27"},{"name":"gudyrmik/CVE-2021-44142","url":"https://github.com/gudyrmik/CVE-2021-44142","stars":1,"created":"2022-04-22"}]},"first":{"date":"2022-03-29","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2021-44142"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-02-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-44142","provenance":"source"},{"date":"2022-03-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2021-44142","provenance":"source"},{"date":"2024-07-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":36,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":68.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 826 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9947"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}