SMB share is writable via NFS protocol and therefore susceptible to CVE 2021-20316

[gwaitsi]

I upgraded to 12.0-8 and once it rebooted, I am getting a number of the below error messages.
SMB share is writable via NFS protocol and therefore susceptible to CVE 2021-20316.

I use a combination of Linux and Windows clients, so the home directories are mapped with nfs and smb as the login can be from either client.

What do i have to do to fix?​

 

[Kris Moore]

There is no fix to this right now. However we've seen many of our customers successfully move to using SMB on the Linux clients now as well. Not only did they get better performance, but it avoids this and other potential corruption issues from running mixed-mode. SMB on Linux is very well supported in 2022 :)

 

[stillka]

more info here:

Samba - Security Announcement Archive

=================================
Workaround and mitigating factors
=================================

Do not enable SMB1 (please note SMB1 is disabled by default in Samba
from version 4.11.0 and onwards). This prevents the creation of
symbolic links via SMB1. If SMB1 must be enabled for backwards
compatibility then add the parameter:

unix extensions = no

to the [global] section of your smb.conf and restart smbd. This
prevents SMB1 clients from creating symlinks on the exported file
system.

However, if the same region of the file system is also exported using
NFS, NFS clients can create symlinks that potentially can also hit the
race condition. For non-patched versions of Samba we recommend only
exporting areas of the file system by either SMB2 or NFS, not both.

 

[sophware]

It's too bad VMware can't use SMB shares as datastores. I have (and have seen a lot of) SMB ISO shares that are really handy to have NFS enabled, so VMware can do key stuff with them. Makes installs easy and fast.

 

[anodos]

It's too bad VMware can't use SMB shares as datastores. I have (and have seen a lot of) SMB ISO shares that are really handy to have NFS enabled, so VMware can do key stuff with them. Makes installs easy and fast.

Does vmware need write access to the ISO share?

 

[sophware]

Does vmware need write access to the ISO share?

Read-only is appropriate.

 

[anodos]

Read-only is appropriate.

Then you should be able to mitigate by converting the NFS export to RO.

 

[anodos]

Here's a LWN article explaining it (the samba side of things): https://lwn.net/SubscriberLink/884052/15bc73887e122c39/
From the NFS-perspective would be a race in Samba on creation of malicious symlink.

 

[Eric Blau]

It seems odd to me to consider switching to SMB when it is Samba that had the security vulnerability to begin with. :)

 

[mudshark]

Is it odd that with several smb shares created identically (music, videos, etc) only the music share gives this error?
Thanks

 

[anodos]

Is it odd that with several smb shares created identically (music, videos, etc) only the music share gives this error?
Thanks

Maybe an issue with how the alert was implemented. It was a temporary issue (having the alert) pending release of TrueNAS 13, which has been released. If you're concerned about the issue upgrade to 13. This issue will not be fixed in 12.