CVE-2021-20208
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file...
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
CVE-2021-20208- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-266, CWE-269
- Updated
- 2026-11-02
CVE List No score
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
CVE-2021-20208- Weakness
- CWE-266
- Updated
- 2026-11-02
EUVDEUVD-2021-7651 No score
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
EUVD-2021-7651- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jx7v-8q27-738q
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file...
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
GHSA-jx7v-8q27-738q- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Weakness
- CWE-266, CWE-269
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-20208
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
ALPINE-CVE-2021-20208- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVAZL-6354
CVE-2021-20208 affecting package cifs-utils for versions less than 6.8-6
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
AZL-6354- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSV
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
CVE-2021-20208- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-20208
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
DEBIAN-CVE-2021-20208- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2021-1193
cifs-utils security update
The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux.
Security Fix(es):
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.(CVE-2021-20208)
- Record
OESA-2021-1193- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-20208
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
- Record
UBUNTU-CVE-2021-20208- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0277 No score
Updated cifs-utils packages fix a security vulnerability
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2021-20208).
- Record
MGASA-2021-0277- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0639-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following security issues:
- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)
This update for cifs-utils fixes the following issues:
-
Solve invalid directory mounting. When attempting to change the current working directory into non-existing directories, mount.cifs crashes. (bsc#1152930)
-
Fixed a bug where it was no longer possible to mount CIFS filesystem after the last maintenance update. (bsc#1184815)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0639-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10683-1 No score
cifs-utils-6.13-1.3 on GA media
These are all security issues fixed in the cifs-utils-6.13-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10683-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1159-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issues:
- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container (bsc#1183239)
- Record
SUSE-SU-2021:1159-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1161-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issues:
- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container (bsc#1183239)
- Record
SUSE-SU-2021:1161-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1455-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following security issues:
- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)
This update for cifs-utils fixes the following issues:
-
Solve invalid directory mounting. When attempting to change the current working directory into non-existing directories, mount.cifs crashes. (bsc#1152930)
-
Fixed a bug where it was no longer possible to mount CIFS filesystem after the last maintenance update. (bsc#1184815)
- Record
SUSE-SU-2021:1455-1- Updated
- 2026-11-02
OSVUSN-5459-1 No score
cifs-utils vulnerabilities
Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14342)
It was discovered that cifs-utils incorrectly used host credentials when mounting a krb5 CIFS file system from within a container. An attacker inside a container could possibly use this issue to obtain access to sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-20208)
It was discovered that cifs-utils incorrectly handled certain command-line arguments. A local attacker could possibly use this issue to obtain root privileges. (CVE-2022-27239)
It was discovered that cifs-utils incorrectly handled verbose logging. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2022-29869)
- Record
USN-5459-1- Updated
- 2026-11-02
OSVUSN-7688-1 No score
cifs-utils vulnerabilities
Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. (CVE-2020-14342)
It was discovered that cifs-utils incorrectly used host credentials when mounting a krb5 CIFS file system from within a container. An attacker inside a container could possibly use this issue to obtain access to sensitive information. (CVE-2021-20208)
It was discovered that cifs-utils incorrectly handled certain command-line arguments. A local attacker could possibly use this issue to obtain root privileges. (CVE-2022-27239)
It was discovered that cifs-utils incorrectly handled verbose logging. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2022-29869)
- Record
USN-7688-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsAlpine:v3.10 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.11 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.12 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.13 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.14 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.15 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.16 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.17 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.18 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.19 |
4.0 up to 6.13-r0 | 6.13-r0 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsAlpine:v3.20 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.21 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.22 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.23 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.24 |
4.0 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAzure Linux:2 |
before 6.8-6 | 6.8-6 |
cifs-utilsDebian:12 |
before 2:6.11-3 | 2:6.11-3 |
cifs-utilsDebian:13 |
before 2:6.11-3 | 2:6.11-3 |
cifs-utilsDebian:14 |
before 2:6.11-3 | 2:6.11-3 |
cifs-utilsMageia:7 |
before 6.9-6.2.mga7 | 6.9-6.2.mga7 |
cifs-utilsMageia:8 |
before 6.11-2.1.mga8 | 6.11-2.1.mga8 |
cifs-utilsopenEuler:20.03-LTS-SP1 |
before 6.10-2.oe1 | 6.10-2.oe1 |
cifs-utilsSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 6.9-13.14.1 | 6.9-13.14.1 |
cifs-utilsSUSE:Linux Enterprise Server 12 SP5 |
before 6.9-13.14.1 | 6.9-13.14.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 6.9-13.14.1 | 6.9-13.14.1 |
cifs-utilsSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 6.9-5.9.1 | 6.9-5.9.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsUbuntu:Pro:14.04:LTS |
before 2:6.0-1ubuntu2+esm1, plus listed versions 2:6.0-1ubuntu2 |
2:6.0-1ubuntu2+esm1 |
cifs-utilsUbuntu:Pro:16.04:LTS |
before 2:6.4-1ubuntu1.1+esm1, plus listed versions 2:6.4-1ubuntu12:6.4-1ubuntu1.1 |
2:6.4-1ubuntu1.1+esm1 |
cifs-utilsUbuntu:18.04:LTS |
before 2:6.8-1ubuntu1.2, plus listed versions 2:6.7-12:6.8-12:6.8-1ubuntu12:6.8-1ubuntu1.1 |
2:6.8-1ubuntu1.2 |
cifs-utilsUbuntu:20.04:LTS |
before 2:6.9-1ubuntu0.2, plus listed versions 2:6.9-0ubuntu12:6.9-12:6.9-1ubuntu0.1 |
2:6.9-1ubuntu0.2 |
cifs-utilsUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 2:6.8-1ubuntu1.2, plus listed versions 2:6.7-12:6.8-12:6.8-1ubuntu12:6.8-1ubuntu1.1 |
2:6.8-1ubuntu1.2 |
cifs-utilsUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 2:6.9-1ubuntu0.2, plus listed versions 2:6.9-0ubuntu12:6.9-12:6.9-1ubuntu0.1 |
2:6.9-1ubuntu0.2 |
cifs-utilsUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 2:6.14-1ubuntu0.1, plus listed versions 2:6.11-3.12:6.14-12:6.14-1build1 |
2:6.14-1ubuntu0.1 |
cifs-utilsUbuntu:Pro:14.04:LTS From an advisory covering 4 CVEs |
before 2:6.0-1ubuntu2+esm1, plus listed versions 2:6.0-1ubuntu2 |
2:6.0-1ubuntu2+esm1 |
cifs-utilsUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 2:6.4-1ubuntu1.1+esm1, plus listed versions 2:6.4-1ubuntu12:6.4-1ubuntu1.1 |
2:6.4-1ubuntu1.1+esm1 |
cifs-utilsopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 6.9-lp152.2.3.1 | 6.9-lp152.2.3.1 |
cifs-utilsopenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 6.13-1.3 | 6.13-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-20208 is a medium vulnerability (CVSS 6.1) in Cifs-utils, published April 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in cifs-utils 6.13-r0.
References
bugzilla.redhat.com/show_bug.cgi?id=1921116
bugzilla.samba.org/show_bug.cgi?id=14651
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4BZSJXROEFHYATAAHHRR6P3HUSMPQB3
nvd.nist.gov/vuln/detail/CVE-2021-20208
Show 41 moreShow less
github.com/advisories/GHSA-jx7v-8q27-738q
security.alpinelinux.org/vuln/CVE-2021-20208
security-tracker.debian.org/tracker/CVE-2021-20208
advisories.mageia.org/MGASA-2021-0277.html
bugs.mageia.org/show_bug.cgi?id=29056
lists.opensuse.org/archives/list/[email protected]/thread/65NUX6IGI72XJIWLCF5QOKIKAWWJUMEY
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1193
suse.com/support/update/announcement/2021/suse-su-20211159-1
bugzilla.suse.com/1183239
ubuntu.com/security/CVE-2021-20208
lists.samba.org/archive/samba-technical/2021-April/136467.html
cve.org/CVERecord?id=CVE-2021-20208