Attachment 18829 Details for Bug 15992 – CVE advisory

CVE advisory

CVE-2026-1933.txt (text/plain), 2.42 KB, created by Volker Lendecke on 2026-02-05 10:50:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-02-05 10:50:48 UTC

Size: 2.42 KB

patch

obsolete

>===========================================================
>== Subject:     Missing access checks on reparse point
>==              operations
>==
>== CVE ID#:     2026-1933
>==
>== Versions:    All versions since Samba 4.21
>==
>== Summary:     On a share marked "read only = yes" and
>==              on file handles opened R/O users can set
>==              or delete the reparse point xattrs on files
>==              that the user has write-access in the file
>==              system for.
>===========================================================
>
>===========
>Description
>===========
>
>Starting with Samba 4.21, users can create and delete NTFS-style
>reparse points (https://en.wikipedia.org/wiki/NTFS_reparse_point) via
>the SMB protocol. The Reparse Point Metadata is stored in an extended
>attribute named "user.SmbReparse". Writing to this xattr requires
>file-system level write permissions.
>
>File systems exported by Samba are marked "read only = yes", so even
>users who have write permissions on the exported files should not be
>able modify them via SMB. For setting and deleting the reparse point
>xattr, the required user-space access checks are missing, so that
>users with file-system level write permissions are able to modify the
>"user.SmbReparse" xattr even on exports marked as read only.
>
>The most prominent use of reparse points is the SMB representation of
>symbolic links. This vulnerability means that users can turn existing
>files where they have write permissions into symlinks as seen by
>Windows and Linux clients even on exports marked as "read only = yes".
>
>==================
>Patch Availability
>==================
>
>Patches addressing this issue have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba $VERSIONS have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
>Score: 4.3 (Medium)
>
>==========
>Workaround
>==========
>
>Remove filesystem-level write permissions from files with reparse
>point xattrs attached.
>
>=======
>Credits
>=======
>
>Originally reported by Asim Viladi Oglu Manizada.
>
>Patches provided by Volker Lendecke of the Samba team.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Flags:

metze: review-

Actions: View

Attachments on bug 15992: 18825 | 18826 | 18827 | 18828 | 18829 | 18830 | 18831 | 18833 | 18835 | 18836 | 18837 | 18838 | 18839 | 18883