Attachment 18830 Details for Bug 15992 – Next version, it's a CVSS 7.1 (High)

Next version, it's a CVSS 7.1 (High)

CVE-2026-1933.txt (text/plain), 2.84 KB, created by Volker Lendecke on 2026-02-05 19:36:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-02-05 19:36:25 UTC

Size: 2.84 KB

patch

obsolete

>===========================================================
>== Subject:     Missing access checks on reparse point
>==              operations
>==
>== CVE ID#:     2026-1933
>==
>== Versions:    All versions since Samba 4.21
>==
>== Summary:     On a share marked "read only = yes" and
>==              on file handles opened R/O users can set
>==              or delete the reparse point xattrs on files
>==              that the user has write-access in the file
>==              system for.
>===========================================================
>
>===========
>Description
>===========
>
>Starting with Samba 4.21, users can create and delete NTFS-style
>reparse points (https://en.wikipedia.org/wiki/NTFS_reparse_point) via
>the SMB protocol. The Reparse Point Metadata is stored in an extended
>attribute named "user.SmbReparse" together with the
>FILE_ATTRIBUTE_REPARSE_POINT bit in the user.DosAttrib xattr.
>
>Writing to these xattrs requires file-system level write
>permissions.
>
>File systems exported by Samba are marked "read only = yes" by
>default, so even users who have write permissions on the exported
>files should not be able modify them via SMB. For setting and deleting
>the reparse point xattr, the required user-space access checks are
>missing, so that users with file-system level write permissions are
>able to modify the "user.SmbReparse" xattr even on exports marked as
>read only.
>
>The most prominent use of reparse points is the SMB representation of
>symbolic links. This vulnerability means that users can turn existing
>files where they have write permissions into symlinks as seen by
>Windows and Linux clients even on exports marked as "read only = yes".
>
>An attacker can also make an entire file system under the same
>conditions unavailable to normal users by turning all existing files
>into symlinks or other types of reparse points. This is not a
>permanent condition, a server administrator can remove the
>"user.SmbReparse" xattr and the FILE_ATTRIBUTE_REPARSE_POINT
>"user.DosAttrib" bit.
>
>==================
>Patch Availability
>==================
>
>Patches addressing this issue have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba $VERSIONS have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
>Score: 7.1 (High)
>
>==========
>Workaround
>==========
>
>Remove filesystem-level write permissions from files with reparse
>point xattrs attached.
>
>=======
>Credits
>=======
>
>Originally reported by Asim Viladi Oglu Manizada.
>
>Patches provided by Stefan Metzmacher of the Samba team.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Flags:

metze: review+

Actions: View

Attachments on bug 15992: 18825 | 18826 | 18827 | 18828 | 18829 | 18830 | 18831 | 18833 | 18835 | 18836 | 18837 | 18838 | 18839 | 18883