Attachment 18883 Details for Bug 15992 – Patch for v4.21 with reviewed-by, without WIP:

[patch] Patch for v4.21 with reviewed-by, without WIP:

CVE-2026-1933-reparse-points-4.21-02.patch (text/plain), 3.47 KB, created by Douglas Bagnall on 2026-03-10 22:28:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Douglas Bagnall

Created: 2026-03-10 22:28:53 UTC

Size: 3.47 KB

patch

obsolete

>From 4732c6abd78166ecb9379ab4bab110f4e6f4409c Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Thu, 5 Feb 2026 20:24:12 +0100
>Subject: [PATCH 1/2] CVE-2026-1933 tests: Fix permissions used for creating
> reparse points
>
>SEC_STD_ALL does not lead to fsp->access_mask to include the required
>bits.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992
>
>Signed-off-by: Volker Lendecke <vl@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>---
> python/samba/tests/smb3unix.py | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/python/samba/tests/smb3unix.py b/python/samba/tests/smb3unix.py
>index 66aa98b5aa9..5388b7f0ee2 100644
>--- a/python/samba/tests/smb3unix.py
>+++ b/python/samba/tests/smb3unix.py
>@@ -408,7 +408,7 @@ class Smb3UnixTests(samba.tests.libsmb.LibsmbTests):
>             tag = 0x80000025
> 
>             f,_,cc_out = c.create_ex('\\reparse',
>-                                     DesiredAccess=security.SEC_STD_ALL,
>+                                     DesiredAccess=security.SEC_FILE_WRITE_ATTRIBUTE,
>                                      CreateDisposition=libsmb.FILE_CREATE,
>                                      CreateContexts=[posix_context(0o600)])
> 
>@@ -421,7 +421,7 @@ class Smb3UnixTests(samba.tests.libsmb.LibsmbTests):
>             c.close(f)
> 
>             f,_,cc_out = c.create_ex('\\reparse',
>-                                     DesiredAccess=security.SEC_STD_ALL,
>+                                     DesiredAccess=security.SEC_FILE_WRITE_ATTRIBUTE,
>                                      CreateDisposition=libsmb.FILE_OPEN,
>                                      CreateContexts=[posix_context(0o600)])
>             c.close(f)
>-- 
>2.43.0
>
>
>From 26942b899203b052b17e07d5190434f89fb79f8f Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Mon, 2 Feb 2026 11:43:37 +0100
>Subject: [PATCH 2/2] CVE-2026-1933 smbd: Add access checks to reparse point
> operations
>
>On a share marked "read only = yes" and on file handles opened R/O
>users can set or delete the reparse point xattrs on files that the
>user has write-access in the file system for. Add the required access
>checks.
>
>Thanks to Asim Viladi Oglu Manizada for reporting the issue.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Volker Lendecke <vl@samba.org>
>---
> source3/modules/util_reparse.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
>diff --git a/source3/modules/util_reparse.c b/source3/modules/util_reparse.c
>index 2694410be4f..74b594a2d6d 100644
>--- a/source3/modules/util_reparse.c
>+++ b/source3/modules/util_reparse.c
>@@ -276,6 +276,14 @@ NTSTATUS fsctl_set_reparse_point(struct files_struct *fsp,
> 		return NT_STATUS_ACCESS_DENIED;
> 	}
> 
>+	if ((fsp->fsp_name->twrp != 0) ||
>+	    ((fsp->access_mask &
>+	      (SEC_FILE_WRITE_DATA | SEC_FILE_WRITE_ATTRIBUTE)) == 0))
>+	{
>+		DBG_DEBUG("Access denied on a readonly handle\n");
>+		return NT_STATUS_ACCESS_DENIED;
>+	}
>+
> 	status = reparse_buffer_check(in_data,
> 				      in_len,
> 				      &reparse_tag,
>@@ -346,6 +354,14 @@ NTSTATUS fsctl_del_reparse_point(struct files_struct *fsp,
> 	uint32_t dos_mode;
> 	int ret;
> 
>+	if ((fsp->fsp_name->twrp != 0) ||
>+	    ((fsp->access_mask &
>+	      (SEC_FILE_WRITE_DATA | SEC_FILE_WRITE_ATTRIBUTE)) == 0))
>+	{
>+		DBG_DEBUG("Access denied on a readonly handle\n");
>+		return NT_STATUS_ACCESS_DENIED;
>+	}
>+
> 	status = fsctl_get_reparse_tag(fsp, &existing_tag);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		return status;
>-- 
>2.43.0
>

Flags:

metze: review+

Actions: View

Attachments on bug 15992: 18825 | 18826 | 18827 | 18828 | 18829 | 18830 | 18831 | 18833 | 18835 | 18836 | 18837 | 18838 | 18839 | 18883