# CVE-2021-44142: Details On A Samba Code Execution Bug Demonstrated At Pwn2Own Austin

Unauthenticated attacker sets malformed org.netatalk.Metadata EA on a file, causing OOB read/write in Samba's vfs_fruit adouble parsing, leading to root RCE.

- Payout: $45,000
- Severity: critical
- Program: -
- Credited: Nguyễn Hoàng Thạch, Billy Jheng Bing-Jhong
- Disclosed: 2022-02-01
- CVE: CVE-2021-44142
- Write-up quality: 8/10
- Original: https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin
- Library page: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-2-1-cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin
- Tags: domain:network impact:privesc impact:rce kind:bounty platform:blog sev:critical tech:linux technique:chained technique:source-review vuln:memory-corruption vuln:rce

**Target:** smbd vfs_fruit module (SMB2_SET_INFO EA / :AFP_AfpInfo stream)
**Root cause:** vfs_fruit parses attacker-controlled org.netatalk.Metadata EA into an adouble structure without validating ADEID_FINDERI/ADEID_FILEDATESI entry sizes, so ad_get_entry can return a pointer to the last byte of ad->data, making subsequent memcpy read/write past the heap buffer.
**Steps:**
1. Configure smb.conf with vfs objects = catia fruit streams_xattr and guest ok = yes (default fruit:metadata=netatalk).
2. As unauthenticated guest, open a file stream named `:AFP_AfpInfo` (ADOUBLE_META).
3. Use SMB2_SET_INFO to set EA `org.netatalk.Metadata` to a crafted AppleDouble blob where the ADEID_FINDERI entry points to the last byte of ad->data.
4. Trigger fruit_pread_meta_adouble (fruit_pread) to leak up to 31 bytes past the heap buffer (ZDI-22-245).
5. Trigger fruit_pwrite_meta_adouble (fruit_pwrite) to write up to 31 bytes past ad->ad_data (ZDI-22-246).
6. Variant: craft ADEID_FILEDATESI to cause 3-byte OOB in ad_getdate/ad_setdate (ZDI-22-244).
**How found:** Researchers noted org.netatalk.Metadata is not in Samba's private EA name list, so arbitrary values reach the adouble parser; code review of fruit_pread/fruit_pwrite showed ad_get_entry returns an attacker-controlled pointer used unchecked in memcpy. Lucas Leong found the ADEID_FILEDATESI variant by checking other unvalidated entry types.
**Exploitation:** Unauthenticated SMB guest sets a malformed Netatalk metadata EA, then reads/writes the :AFP_AfpInfo stream to trigger OOB heap read and write in smbd; demonstrated at Pwn2Own Austin 2021 to achieve code execution as root in the smbd context.
**Escalation:** Chained OOB read (info leak) with OOB write to corrupt heap and gain root code execution in smbd.
**Insight:** When a module parses a binary struct from an EA/xattr that isn't on the protected-name list, audit every entry-type accessor (not just the one in the PoC) for missing size validation against the buffer end; sibling entry IDs often share the same unchecked pattern.