CVE-2021-20208

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-19 · updated 2026-06-17
Weakness: CWE-266

Description

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected products

Fedoraproject Fedora: 33, 34, 35
Red Hat Enterprise Linux: 7.0, 8.0
samba cifs-utils: from 4.0 before 6.13 — fixed in 6.13

How to fix

Upgrade to a fixed version: samba cifs-utils 6.13. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1921116
https://bugzilla.samba.org/show_bug.cgi?id=14651
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4HSDIWXXNQBUW5ZS37RQMLJ7THK5AS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WJ3SVBHCSNQZAWSGLB6FBOCFU45FFG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4BZSJXROEFHYATAAHHRR6P3HUSMPQB3/
https://bugzilla.redhat.com/show_bug.cgi?id=1921116
https://bugzilla.samba.org/show_bug.cgi?id=14651
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4HSDIWXXNQBUW5ZS37RQMLJ7THK5AS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WJ3SVBHCSNQZAWSGLB6FBOCFU45FFG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4BZSJXROEFHYATAAHHRR6P3HUSMPQB3/

Get alerted when CVE-2021-20208 or the next vulnerability affects your stack