CVE-2021-43566: Samba Race Condition Vulnerability

CVE-2021-43566 Overview

CVE-2021-43566 is a race condition vulnerability affecting all versions of Samba prior to 4.13.16. A malicious client can exploit an SMB1 or NFS race condition to create directories in areas of the server file system that are not exported under the share definition. This vulnerability requires either SMB1 to be enabled or the share to be available via NFS for exploitation to succeed.

Critical Impact

Unauthorized directory creation outside of exported share boundaries could allow attackers to place files in unexpected server locations, potentially enabling further attacks or data integrity issues.

Affected Products

• Samba versions prior to 4.13.16
• Systems with SMB1 protocol enabled
• Systems with NFS shares configured alongside Samba

Discovery Timeline

• 2022-01-11 - CVE CVE-2021-43566 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43566

Vulnerability Analysis

This vulnerability is classified as CWE-362 (Race Condition). The flaw exists in how Samba handles concurrent file system operations when serving requests through SMB1 or NFS protocols. Due to improper synchronization between time-of-check and time-of-use operations, an attacker can exploit the timing window to manipulate directory creation operations.

The attack requires local access and specific conditions to be met—SMB1 must be enabled or the share must be accessible via NFS. The exploitation complexity is high due to the precise timing required to win the race condition. If successful, the attacker can create directories outside the intended share boundaries, which could lead to integrity violations on the file system.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition in Samba's file system path handling. When processing directory creation requests, Samba validates the target path against share definitions, but there exists a timing gap between this validation and the actual directory creation operation. A malicious client can exploit this window by manipulating symbolic links or path components during the race window.

Attack Vector

The attack vector requires local access to the system with low privileges. The attacker must have legitimate access to an SMB1 or NFS share and the ability to send carefully timed requests to exploit the race condition. The attack involves:

1. Establishing a connection to a legitimate Samba share via SMB1 or NFS
2. Initiating a directory creation request with a crafted path
3. Racing against the server's path validation to manipulate the target location
4. Successfully creating a directory outside the exported share boundaries

Due to the complexity of timing the race condition precisely, exploitation requires multiple attempts and favorable conditions. For detailed technical information, refer to the Samba Bugzilla Report #13979.

Detection Methods for CVE-2021-43566

Indicators of Compromise

• Unexpected directories appearing outside of defined Samba share paths
• Unusual SMB1 or NFS traffic patterns with rapid repeated requests
• Log entries showing directory creation failures followed by successes in unusual locations
• Anomalous file system activity in non-exported areas of the server

Detection Strategies

• Monitor Samba audit logs for directory creation operations targeting unexpected paths
• Implement file integrity monitoring (FIM) on the server file system to detect unauthorized directory creation
• Enable detailed SMB auditing to track all file system operations from connected clients
• Deploy SentinelOne agents to detect anomalous file system operations and race condition exploitation attempts

Monitoring Recommendations

• Configure Samba logging to capture all directory creation events with log level = 3 or higher
• Set up alerts for any directory creation operations outside defined share boundaries
• Monitor for rapid sequences of similar requests that could indicate race condition exploitation attempts
• Review NFS and SMB1 connection logs regularly for suspicious client behavior

How to Mitigate CVE-2021-43566

Immediate Actions Required

• Upgrade Samba to version 4.13.16 or later immediately
• Disable SMB1 protocol if not required for business operations by setting server min protocol = SMB2 in smb.conf
• Review and restrict NFS exports to minimize exposure
• Audit existing share definitions and file system permissions

Patch Information

Samba has released security patches addressing this vulnerability in version 4.13.16 and later. Organizations should update their Samba installations to the latest available version. For detailed patch information and release notes, consult the Samba CVE-2021-43566 Security Advisory.

Additional vendor advisories are available from NetApp Security Advisory for affected NetApp products.

Workarounds

• Disable SMB1 protocol by adding server min protocol = SMB2 to the [global] section of smb.conf
• Disable NFS access to Samba shares if not operationally required
• Implement strict file system permissions to limit the impact of unauthorized directory creation
• Use chroot or containerization to isolate Samba services from sensitive file system areas

# Configuration example - Disable SMB1 in smb.conf
[global]
    server min protocol = SMB2
    # Additional hardening options
    restrict anonymous = 2
    log level = 3