Samba 4

Plugin tenable:157360 bundles three Samba issues behind one version check: CVE-2021-44142 (root RCE in vfs_fruit), CVE-2021-44141 (SMB1 symlink existence leak), and CVE-2022-0336 (Samba AD DC SPN alias bypass). The affected upstream ranges are broadly 4.0.0 through <4.13.17, 4.14.x <4.14.12, and 4.15.x <4.15.5, but the dangerous path is not universal: CVE-2021-44142 only bites when vfs_fruit is enabled with vulnerable defaults and the attacker can write file metadata; CVE-2022-0336 matters only on Samba AD DC; CVE-2021-44141 needs SMB1 plus Unix extensions.

Tenable's HIGH label is defensible as a worst-case umbrella, but it's too generous for fleet-wide prioritization because the plugin is version-only and ignores the configuration gates that decide exploitability. In real enterprise estates this usually lands as a post-initial-access or niche-appliance problem, not a broad unauthenticated internet worm scenario, so I would downgrade it to MEDIUM unless you confirm writable fruit shares on NAS/Time Machine infrastructure or Samba AD DC exposure.

Why this verdict

• Down from vendor HIGH: the root-RCE path (CVE-2021-44142) is gated by vfs_fruit, which is common on some NAS/Time Machine setups but not default across generic Linux Samba installs.
• Another step down: the attacker still needs write access to a share or metadata path, which implies internal position, valid credentials, or an unusually weak guest-write configuration.
• More downward pressure: CVE-2022-0336 is Samba AD DC only and requires the ability to write an account's servicePrincipalName; that is post-auth and permission-dependent, not broad pre-auth reach.
• Detection quality matters: Tenable plugin 157360 is a version-only remote check, so distro backports and non-exploitable configs inflate patch queues unless you verify locally.
• Not IGNORE: if the host is a NAS or file server with fruit and writable shares, compromise lands in smbd context, typically root, which is plenty of blast radius for data theft and lateral movement.

Why not higher?

I am not putting this in HIGH or CRITICAL for fleet scheduling because the exploit chain is not broadly reachable on default Samba installs. No reviewed source showed KEV status or active widespread exploitation, and both the fruit requirement and the write-access requirement substantially narrow who can hit the RCE path in real enterprise deployments.

Why not lower?

I am not dropping this to LOW because the upside for an attacker on a truly exposed host is excellent: remote code execution as root on a file server or NAS that often holds shared data and credentials. If you confirm vfs_fruit on writable shares, this stops being a paperwork CVE and becomes a real lateral-movement accelerator.

1. Inventory fruit immediately — On every Samba/NAS host, confirm whether vfs objects includes fruit and whether the host is serving macOS/Time Machine shares. For a MEDIUM verdict there is no mitigation SLA, but do this in the next normal ops cycle so you can separate real exposure from version-only noise before spending patch windows.
2. Remove fruit where not needed — If Apple compatibility is not a business requirement, remove fruit from smb.conf and reload Samba. This is the cleanest exposure reducer for CVE-2021-44142; apply it ahead of the patch if change control is faster than package deployment.
3. Kill guest-write shares — Review shares for combinations like writable plus guest access, especially on NAS appliances and collaboration drops. That closes the easiest path to the RCE chain and should be folded into your next routine config hardening pass.
4. Disable SMB1 and Unix extensions — This specifically neutralizes the CVE-2021-44141 symlink existence leak. If you still have SMB1 enabled for legacy reasons, treat that as a separate hygiene problem and remove it during the normal remediation window.
5. Audit delegated SPN write rights — On Samba AD DC systems, review who can modify servicePrincipalName attributes and reduce that permission to the minimum set of join/admin workflows. This contains the CVE-2022-0336 path without waiting on patch validation.

Run this on the target Samba host from a local shell, not from an auditor workstation. Invoke with sudo bash samba_157360_check.sh /etc/samba/smb.conf; root is recommended so testparm can read the active config and includes. The script returns exit 1 for VULNERABLE, 0 for PATCHED, and 2 for UNKNOWN.

#!/usr/bin/env bash
# samba_157360_check.sh
# Check exposure relevant to Tenable plugin 157360:
# - CVE-2021-44142 (vfs_fruit RCE)
# - CVE-2021-44141 (SMB1 + unix extensions info leak)
# - CVE-2022-0336 (Samba AD DC SPN alias bypass)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

CFG="${1:-/etc/samba/smb.conf}"

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$1" != "$2" ] && ! ver_ge "$1" "$2"
}

extract_ver() {
  local raw="$1"
  echo "$raw" | grep -Eo '[0-9]+(\.[0-9]+){1,3}' | head -n1
}

get_samba_ver() {
  local v=""
  if have_cmd smbd; then
    v=$(smbd -V 2>/dev/null || true)
    extract_ver "$v"
    return
  fi
  if have_cmd samba; then
    v=$(samba -V 2>/dev/null || true)
    extract_ver "$v"
    return
  fi
  echo ""
}

get_testparm_dump() {
  if have_cmd testparm; then
    testparm -s "$CFG" 2>/dev/null || true
  else
    cat "$CFG" 2>/dev/null || true
  fi
}

VER=$(get_samba_ver)
if [ -z "$VER" ]; then
  echo "UNKNOWN - could not determine Samba version (missing smbd/samba)"
  exit 2
fi

DUMP=$(get_testparm_dump)
if [ -z "$DUMP" ]; then
  echo "UNKNOWN - could not read Samba configuration from $CFG"
  exit 2
fi

# Version gate for upstream vulnerable ranges covered by plugin 157360.
VULN_VERSION=1
if ver_ge "$VER" "4.15.5"; then
  VULN_VERSION=0
elif ver_ge "$VER" "4.14.12" && ver_lt "$VER" "4.15.0"; then
  VULN_VERSION=0
elif ver_ge "$VER" "4.13.17" && ver_lt "$VER" "4.14.0"; then
  VULN_VERSION=0
fi

if [ "$VULN_VERSION" -eq 0 ]; then
  echo "PATCHED - Samba version $VER is at or above fixed upstream thresholds"
  exit 0
fi

# Configuration checks.
FRUIT=0
if echo "$DUMP" | grep -Eiq '^[[:space:]]*vfs objects[[:space:]]*=.*\bfruit\b'; then
  FRUIT=1
fi

SERVER_ROLE="$(echo "$DUMP" | awk -F= '/^[[:space:]]*server role[[:space:]]*=/{gsub(/^[ \t]+|[ \t]+$/, "", $2); print tolower($2); exit}')"
ADDC=0
if echo "$SERVER_ROLE" | grep -q 'active directory domain controller'; then
  ADDC=1
fi

# SMB1/unix extensions path for CVE-2021-44141.
SMB1=0
if echo "$DUMP" | grep -Eiq '^[[:space:]]*server min protocol[[:space:]]*=.*NT1'; then
  SMB1=1
fi
UNIXEXT=1
if echo "$DUMP" | grep -Eiq '^[[:space:]]*unix extensions[[:space:]]*=.*no'; then
  UNIXEXT=0
fi

# Share writability heuristic.
WRITABLE=0
if echo "$DUMP" | grep -Eiq '^[[:space:]]*(read only|write ok|writable)[[:space:]]*=.*(no|yes)'; then
  # If any share says read only = no OR write ok/writable = yes, treat as writable.
  if echo "$DUMP" | grep -Eiq '^[[:space:]]*read only[[:space:]]*=.*no'; then WRITABLE=1; fi
  if echo "$DUMP" | grep -Eiq '^[[:space:]]*(write ok|writable)[[:space:]]*=.*yes'; then WRITABLE=1; fi
fi

GUESTWRITE=0
if [ "$WRITABLE" -eq 1 ] && echo "$DUMP" | grep -Eiq '^[[:space:]]*guest ok[[:space:]]*=.*yes'; then
  GUESTWRITE=1
fi

# Decision logic.
if [ "$FRUIT" -eq 1 ] && [ "$WRITABLE" -eq 1 ]; then
  echo "VULNERABLE - version $VER with vfs_fruit enabled and at least one writable share"
  exit 1
fi

if [ "$ADDC" -eq 1 ]; then
  echo "VULNERABLE - version $VER and host appears to be a Samba AD DC (CVE-2022-0336 path applies)"
  exit 1
fi

if [ "$SMB1" -eq 1 ] && [ "$UNIXEXT" -eq 1 ]; then
  echo "VULNERABLE - version $VER with SMB1/NT1 and unix extensions enabled (CVE-2021-44141 path applies)"
  exit 1
fi

# If only version is old but none of the exploit-driving configs are seen, avoid false certainty.
echo "UNKNOWN - vulnerable version $VER detected, but no high-confidence exploitable config found; check distro backports, included configs, and appliance vendor patches"
exit 2

Sources

1. Tenable Nessus Plugin 157360
2. Samba advisory for CVE-2021-44142
3. Samba advisory for CVE-2021-44141
4. Samba advisory for CVE-2022-0336
5. ZDI analysis of CVE-2021-44142
6. JFrog technical analysis of CVE-2021-44142
7. CISA alert on Samba security updates
8. Ubuntu CVE page showing backported fixes