CVE-2021-20254: Debian Linux

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only
• Samba Samba: from 3.6.0, before 4.12.15 (fixed in 4.12.15); from 4.13.0, before 4.13.8 (fixed in 4.13.8); from 4.14.0, before 4.14.4 (fixed in 4.14.4)

Published 2021-05-05. Last modified 2026-06-17.