CVE-2021-20208 log

Source
Severity Medium
Remote No
Type Information disclosure
Description 
A security issue was found in cifs-utils in versions before 6.13. When a container process causes an operation that trigger the kernel to ask a userspace for user credentials for an SMB filesystem, cifs.upcall utility may indirectly leak an information about Kerberos credentials available in the host environment and cause non-sanctioned SMB filesystem access in the container.
Group Package Affected Fixed Severity Status Ticket
AVG-1839 cifs-utils 6.12-1 6.13-1 Medium Fixed
References 
https://lists.samba.org/archive/samba-technical/2021-April/136467.html
https://bugzilla.samba.org/show_bug.cgi?id=14651
https://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=e461afd8cfa6d0781ae0c5c10e89b6ef1ca6da32
Notes 
Workaround
==========

For host systems that cannot be updated, DFS and multiuser mounts can be disabled in the container SMB mounts options i.e. adding 'nodfs' and removing 'multiuser' (if present).