Attachment 18833 Details for Bug 15992 – Patch for 4.24

[patch] Patch for 4.24

CVE-2026-1933-reparse-points-4.24-01.patch (text/plain), 3.46 KB, created by Volker Lendecke on 2026-02-06 10:48:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-02-06 10:48:59 UTC

Size: 3.46 KB

patch

obsolete

>From 0b5772433a66410696af2bc9e988d157744aa3c6 Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Thu, 5 Feb 2026 20:24:12 +0100
>Subject: [PATCH 1/2] WIP: CVE-2026-1933 tests: Fix permissions used for
> creating reparse points
>
>SEC_STD_ALL does not lead to fsp->access_mask to include the required
>bits.
>
>Signed-off-by: Volker Lendecke <vl@samba.org>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992
>---
> python/samba/tests/smb3unix.py | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/python/samba/tests/smb3unix.py b/python/samba/tests/smb3unix.py
>index 075b2a07b17..3039a68a1cd 100644
>--- a/python/samba/tests/smb3unix.py
>+++ b/python/samba/tests/smb3unix.py
>@@ -446,7 +446,7 @@ class Smb3UnixTests(samba.tests.libsmb.LibsmbTests):
> 
>             wire_mode = libsmb.unix_mode_to_wire(0o600)
>             f,_,cc_out = c.create_ex('\\reparse',
>-                                     DesiredAccess=security.SEC_STD_ALL,
>+                                     DesiredAccess=security.SEC_FILE_WRITE_ATTRIBUTE,
>                                      CreateDisposition=libsmb.FILE_CREATE,
>                                      CreateContexts=[posix_context(wire_mode)])
> 
>@@ -460,7 +460,7 @@ class Smb3UnixTests(samba.tests.libsmb.LibsmbTests):
> 
>             wire_mode = libsmb.unix_mode_to_wire(0o600)
>             f,_,cc_out = c.create_ex('\\reparse',
>-                                     DesiredAccess=security.SEC_STD_ALL,
>+                                     DesiredAccess=security.SEC_FILE_WRITE_ATTRIBUTE,
>                                      CreateDisposition=libsmb.FILE_OPEN,
>                                      CreateContexts=[posix_context(wire_mode)])
>             c.close(f)
>-- 
>2.47.3
>
>
>From 004e87e22f90166461ffcd30eff177632b11d8c1 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Mon, 2 Feb 2026 11:43:37 +0100
>Subject: [PATCH 2/2] WIP: CVE-2026-1933 smbd: Add access checks to reparse
> point operations
>
>On a share marked "read only = yes" and on file handles opened R/O
>users can set or delete the reparse point xattrs on files that the
>user has write-access in the file system for. Add the required access
>checks.
>
>Thanks to Asim Viladi Oglu Manizada for reporting the issue.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>---
> source3/modules/util_reparse.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
>diff --git a/source3/modules/util_reparse.c b/source3/modules/util_reparse.c
>index 60373d7fd4e..75aa745e070 100644
>--- a/source3/modules/util_reparse.c
>+++ b/source3/modules/util_reparse.c
>@@ -320,6 +320,14 @@ NTSTATUS fsctl_set_reparse_point(struct files_struct *fsp,
> 		return NT_STATUS_ACCESS_DENIED;
> 	}
> 
>+	if ((fsp->fsp_name->twrp != 0) ||
>+	    ((fsp->access_mask &
>+	      (SEC_FILE_WRITE_DATA | SEC_FILE_WRITE_ATTRIBUTE)) == 0))
>+	{
>+		DBG_DEBUG("Access denied on a readonly handle\n");
>+		return NT_STATUS_ACCESS_DENIED;
>+	}
>+
> 	status = reparse_buffer_check(in_data,
> 				      in_len,
> 				      &reparse_tag,
>@@ -390,6 +398,14 @@ NTSTATUS fsctl_del_reparse_point(struct files_struct *fsp,
> 	uint32_t dos_mode;
> 	int ret;
> 
>+	if ((fsp->fsp_name->twrp != 0) ||
>+	    ((fsp->access_mask &
>+	      (SEC_FILE_WRITE_DATA | SEC_FILE_WRITE_ATTRIBUTE)) == 0))
>+	{
>+		DBG_DEBUG("Access denied on a readonly handle\n");
>+		return NT_STATUS_ACCESS_DENIED;
>+	}
>+
> 	status = fsctl_get_reparse_tag(fsp, &existing_tag);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		return status;
>-- 
>2.47.3
>

Flags:

metze: review+
vl: ci-passed+

Actions: View

Attachments on bug 15992: 18825 | 18826 | 18827 | 18828 | 18829 | 18830 | 18831 | 18833 | 18835 | 18836 | 18837 | 18838 | 18839 | 18883