Attachment 18825 Details for Bug 15992 – Patch for master

[patch] Patch for master

CVE-2026-1933-reparse-points-master-01.patch (text/plain), 1.55 KB, created by Volker Lendecke on 2026-02-05 10:11:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-02-05 10:11:28 UTC

Size: 1.55 KB

patch

obsolete

>From 39efa7944d0486526cd307cae127b94697e870bf Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Mon, 2 Feb 2026 11:43:37 +0100
>Subject: [PATCH] WIP: CVE-2026-1933 smbd: Add access checks to reparse point
> operations
>
>On a share marked "read only = yes" and on file handles opened R/O
>users can set or delete the reparse point xattrs on files that the
>user has write-access in the file system for. Add the required access
>checks.
>
>Thanks to Asim Viladi Oglu Manizada for reporting the issue.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992
>Signed-off-by: Volker Lendecke <vl@samba.org>
>---
> source3/modules/util_reparse.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
>diff --git a/source3/modules/util_reparse.c b/source3/modules/util_reparse.c
>index 60373d7fd4e..75af0a9d506 100644
>--- a/source3/modules/util_reparse.c
>+++ b/source3/modules/util_reparse.c
>@@ -320,6 +320,11 @@ NTSTATUS fsctl_set_reparse_point(struct files_struct *fsp,
> 		return NT_STATUS_ACCESS_DENIED;
> 	}
> 
>+	if (!fsp->fsp_flags.can_write) {
>+		DBG_DEBUG("Access denied on a readonly handle\n");
>+		return NT_STATUS_ACCESS_DENIED;
>+	}
>+
> 	status = reparse_buffer_check(in_data,
> 				      in_len,
> 				      &reparse_tag,
>@@ -390,6 +395,11 @@ NTSTATUS fsctl_del_reparse_point(struct files_struct *fsp,
> 	uint32_t dos_mode;
> 	int ret;
> 
>+	if (!fsp->fsp_flags.can_write) {
>+		DBG_DEBUG("Access denied on a readonly handle\n");
>+		return NT_STATUS_ACCESS_DENIED;
>+	}
>+
> 	status = fsctl_get_reparse_tag(fsp, &existing_tag);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		return status;
>-- 
>2.51.0
>

Flags:

metze: review-

Actions: View

Attachments on bug 15992: 18825 | 18826 | 18827 | 18828 | 18829 | 18830 | 18831 | 18833 | 18835 | 18836 | 18837 | 18838 | 18839 | 18883