Critical Samba flaw presents code execution threat | Hacker News Reader

Critical Samba flaw presents code execution threat

portswigger.net

74 pointsfeross41 comments

https://www.samba.org/samba/security/CVE-2021-44142.html

Thank you. And for those that don't know why you would want fruit when dancing:

> vfs_fruit — Enhanced OS X and Netatalk interoperability Synopsis

> (...)

> The vfs_fruit module provides enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.

https://www.samba.org/samba/docs/current/man-html/vfs_fruit....

This could impact NAS devices from Synology and QNAP.

These companies use old kernels, offer a lot of fancy features and are also slow to patch.

Synology has had a patch since January 26th - https://www.synology.com/en-us/security/advisory/Synology_SA...

is that enabled by default?

previously I've had to enable vfs objects manually

No it is not enabled by default.

Oh dear - that makes the title a bit clickbaity.

I wondered what vfs_fruit was.

https://www.samba.org/samba/docs/current/man-html/vfs_fruit....

I've never had to tangle with (OSX or Apple) and Samba, which explains my ignorance.

It's not clear whether you have to actually use the driver, or whether the vuln is exposed simply by mentioning it in a config file.

Putting it in the vfs objects = list causes the module to be loaded, so enabling the vulnerability.

I don't think it's clickbaity. Some distros do enable it by default, since it helps Apple compatibility.

Samba is SO SLOW in Mac as well. My gigabit local ethernet connection is somehow slower than my internet connection. Anyone have suggestions of what to use besides SMB?

More details please. What server are you connecting to locally ?

Ubuntu 20.04

https://forums.macrumors.com/threads/very-slow-access-to-smb...

Google search "SMB Slow on Mac"

Are you using signing/encryption ? Never mind, saw the local "gigabit connection" above, so wired.

Since MacOS 10.11.5 SMB signing is enabled by default which does impact performance.

NFS would be the traditional *nix answer there.

SMB is also moderately CPU bottlenecked, especially depending on cipher suite, so if you're connecting to a super slow raspberry pi server or something, move to a decent server before writing it all off.

NFS has its own issues, such as not being authenticated. SMB does support credentials and TLS for access.

Even better having $HOME mounted via NFS and then getting to go for a coffee because being unable to login due to file server issues with nfsd.

NFSv4 does support authentication via Kerberos and other providers, but its support on Mac is really patchy.

There are AFS servers for Linux. I don't know if macOS supports NFS shares, but if it does then that should be speedier.

That said my Samba server does saturate a gigabit connection with a Windows client. The CPU usage on the server is around 25% when doing so, with a crappy low end AMD dual core from 2013 so the CPU shouldn't be a bottleneck.

Yes, one such is https://wiki.archlinux.org/title/Netatalk

Though haven’t Apple deprecated [0][1] AFS in Mavericks 10.9 in favour of SMB?

[0] https://eclecticlight.co/2019/12/09/can-you-still-use-afp-sh...

[1] https://www.macworld.com/article/234926/using-afp-to-share-a...

Yes, NFS shares can be (auto)mounted on OSX. It works well if you don't require authentication in the protocol. I have some devices setup this way on my LAN and the only "tricky" part is making sure your uids/gids align with the file perms on the server.

Is there any non-airgapped use case that doesn't require authentication?

NFS sounds great when presented as a "faster alternative to samba". As soon as anything else is said about it you realize there's a reason it's been a bad choice for 20 years.

> Is there any non-airgapped use case that doesn't require authentication?

Here's one: Say you maintain the devices in your home LAN/WLAN, and you would like to centralize the storage/access of certain data like photos, music, video, shared Keepass DB files, etc. Let's also assume that you don't have a local threat model in your home network that includes "highly technical people that know about setting their UID who wish to access files you don't want them to see or have write access to". I would argue this is a semi-common home scenario for many of us. Perhaps you want your SO and/or child to have access to shared files on a NAS which supports NFS, and you don't have any Windows endpoints to worry about.

In this scenario it's perfectly fine to just setup the devices which you want to have access to the NFS share(s) and completely ignore authentication for the file sharing protocol. If you're worried about WiFi guests that might be savvy or curious then simply create a guest-only wireless network that can get out to the internet but not the LAN.

The above works fine for me, personally.

LANs aren't air-gapped though and are insecure (yes I know stateful firewalls and good hygiene, still insecure).

When that network is compromised you'll want a layer of authentication between an attacker and your filesystem.

In my experience trying to export AFS mounts from my NAS for TimeMachine is that it is a regular headache when Apple randomly breaks it.

Some patch will drop and suddenly my wife will be complaining about popups on her machines about failed TimeMachine backups and often I have to delete the entire backup and start over from scratch which takes hours and days, especially on the laptops that are doing it over the wireless.

> Samba is SO SLOW

Are you using SMBv3? Here are some comparison stats [1]

[1] https://photographylife.com/afp-vs-nfs-vs-smb-performance

sshfs?

https://github.com/libfuse/sshfs

Beware it’s now a PITA to install sshfs via Homebrew because macFUSE, a dep for sshfs has turned closed-source and Homebrew would refuse to install sshfs for that reason.

To solve it, you’d have to install macFUSE binary from their official site first, and load their kernel extension via the GUI, before running the Homebrew command.

MacOS is the Samba client or server? At home my FreeBSD samba server will saturate 1 Gb to a Windows 7 client. I used to use it with a Linux mint server that was slightly slower but still plenty fast (~80MB/sec vs 100+ for Windows)

The problem is that they aren't using Samba, they are using their own SMB implementation. They had to move after Samba went GPL3, and it hasn't been as performant or stable since (although recently it's a little better).

https://www.osnews.com/story/24572/apple-ditches-samba-in-fa...

Well they didn't have to move, just to be captain pedantic :-). They chose to do so, as they made a policy decision not to use any GPLv3 code. Which is their right to do so, of course.

Apple have been moving to only permissively licenced code for a while now.

Sorry, a genuine question: it seems that they have to move as GPLv3 is anti-tivolization and Apple is TiVo-like (namely macOS are only licensed on Apple hardware.)

So in this case apple’s action is a direct response to FSF’s decision to be anti-tivolization? Ie they are forced to either change their model to comply, or not use GPLv3 licensed softwares?

Well for Apples motives you would have to ask Apple.

But from an external view of Apple, yes - this does seem to be a direct response to the GPLv3 anti-tivoization clause. Again, this is perfectly within their rights so I don't want anyone to think I'm complaining about this (anymore:-).

I'm more annoyed with the FSF over GPLv3 than Apple. At least Apple have the courage of their convictions, which cannot be said anymore of the FSF.

The wife is going to be tickled with this module name...

The article probably should probably mention that this vfs_fruit module provides Apple-specific features and is mostly used to allow Samba to be the target for Mac Time Machine backups.

"The vfs_fruit module provides enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver."

I don't even use Samba. NFS is supported on Windows 10/11 for when I have to use Windows.

For merely copying files NFS is fine (personally I use scp for that). But when you need to host content that Windows apps want to use with full Windows semantics, then SMB is the way to go.

Can you give a few examples of apps where this is a real problem?

Microsoft Office (local versions of course) is the main offender here :-). I'm not sure how much testing they do against non-Windows servers.

Note that NFS support on Windows is only for pro editions, quite frustratingly.

Reply on news.ycombinator.com