CVE-2021-20208

Description


A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

References


Issue TrackingPatchVendor Advisory

Issue TrackingThird Party Advisory

CvssV3 impact


BaseSeverity

MEDIUM

ConfidentialityImpact

LOW

AttackComplexity

HIGH

Scope

CHANGED

AttackVector

LOCAL

AvailabilityImpact

NONE

IntegrityImpact

HIGH

PrivilegesRequired

LOW

BaseScore

6.1

VectorString

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

Version

3.1

UserInteraction

REQUIRED

CvssV2 impact


AccessComplexity

MEDIUM

ConfidentialityImpact

PARTIAL

AvailabilityImpact

NONE

IntegrityImpact

PARTIAL

BaseScore

4.9

VectorString

AV:N/AC:M/Au:S/C:P/I:P/A:N

Version

2.0

AccessVector

NETWORK

Authentication

SINGLE