Are there sernet packages with debug symbols?

Could be already fixed by 23f72c4d712f8d1fec3d67a66d477709d5b0abe2 or 2852dce541e7d923b1a2807f9ba29b62b043d219.

(In reply to Douglas Bagnall from comment #1)

On debian/ubuntu we have sernet-samba-dbg.
On rhel/centos/oracle 6/7 we have sernet-samba-debuginfo
On rhel/centos/oracle 8 each sernet-samba* packages
has its sernet-samba*-debuginfo packages and there's
a sernet-samba-debugsource package.

I'd have to research why suse/sles packages don't have debuginfo packages.

Adam, can we use this one for the bug for the moment, not #14075, because there may be security implications if people can trigger the crash remotely, and this bug is restricted to you and the Samba developers. It will be made public later.

Are you able to install the debug packages for samba? They should be called something like sernet-samba-debuginfo. Installing those will provide a traceback with more detail.

I have install sernet-samba-debuginfo. and what shoud I do next?

you will have a script like /usr/share/samba/panic-action on your system. You can add

panic action = "/usr/share/samba/panic-action %d"

to your smb.conf. This will trigger a mail to root with a helpful set of debuggin information when a samba process crashes.

PS: you should have /usr/bin/gdb and a "mail" binary installed also.

(In reply to Björn Jacke from comment #6)
seems no panic-action script in sernet-samba-debuginfo rpm package. there are just a lot .c and .h file in /usr/src/debug/samba-4.10.6.

How cloud I get panic-action script?

(In reply to Adam Xu from comment #8)
Hi Adam,

it's /usr/share/samba/panic-action and comes with sernet-samba-common package.

Hope that helps.

Karolin

Created attachment 15394 [details]
panic-action file

there's no panic-action in sernet-samba-common rpm package also.
someone send me a panic-action file from mail. but it didn't work.
I have installed gdb and samba debug package. I have added configration like:
[global]
......
        panic action = "/usr/local/bin/panic-action %d"

the error occurs but nothing logs to my system mail.
I have uploaded panic-action to the attachement. please help.

Remember you can debug a panic action by sending signal 11 to the target process, rather than inducing the crash. 

This may assist you in getting us the backtrace we need.

Or just set 'panic action = /bin/sleep 9999999' and attach with gdb -p $PID manually.

We need, one way or the other, a 'bt full' from the crashing process.

you need to remove the " " from the panic action. This is inconsistent from smbd and samba ad. The man page example got the " " removed already now. Does it give you a debug info mail in case of a crash if you change that?

(In reply to Björn Jacke from comment #13)
thank you. I got some debug info after I removed the "" from smb.conf. I will upload the system mail file to attachment.

Created attachment 15488 [details]
debug info file via mail

This is the block where the NULL de-reference happens. 

		attr = dsdb_attribute_by_lDAPDisplayName(dsc->schema,
				el->name);
		keep = false;

		if (attr->linkID & 1) {
			/*
			 * Attribute is a backlink so let's remove it
			 */
			continue;
		}

The implication is that this happens in conjunction with ranged_results, because we have 

ldapattrname =3D 0x55f7b5186a00 "member;range=3D1-1"

which is why attr is NULL and so we fault.

(In reply to Andrew Bartlett from comment #16)
Now we understand it it is pretty clear for me that we will need a CVE for this.

I've asked Red Hat for one.

(In reply to Douglas Bagnall from comment #2)
Yes, almost certainly already fixed by 23f72c4d712f8d1fec3d67a66d477709d5b0abe2.

Yay for proactive fixes from static analysis, this means that Samba 4.11 is not impacted.

 CVSS v3.1 Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5)

This is on the basis that we can crash the prefork and single-mode LDAP server, and prefork is now a well supported option in Samba 4.10. 

Samba 4.8 and installations of Samba 4.9 and 4.10 using the default 'standard' process model are not impacted (this is a self-DoS of the attackers own connection).  Samba 4.11 is not impacted as the bug was already fixed.

However, versions of Samba earlier than Samba 4.7 are, as they always ran the LDAP server in single process mode.

Fixing the crash is simple, and the patch in master does that.  It essentially neuters ranged_results for that attribute however, any attribute not found (due to the ;) will just not be reported.

We can just do that for the security fix, but for master and supported releases we should try and fix the server to match the MS Windows behaviour.

I've confirmed that 23f72c4d712f8d1fec3d67a66d477709d5b0abe2 fixes it, when backported to Samba 4.10.

Steps to reproduce:

make testenv

 bin/ldbsearch -H ldb://`pwd`/st/ad_dc/private/sam.ldb --controls="dirsync:1:0:0" -U$USERNAME%$PASSWORD
(for a local crash)

 bin/ldbsearch -H ldap://$SERVER --controls="dirsync:1:0:0" -U$USERNAME%$PASSWORD cn=administrators 'member;range=1-1'
(for a 'remote' crash against the running LDAP server).

Testing against windows 1703 shows that the ;range=1-1 part is lost when dirsync is in use, the full result is returned.

Created attachment 15539 [details]
patch for master and v4.11 (to fix behaviour only) v1

Created attachment 15540 [details]
patch for Samba 4.9 (cherry-picked of security fix from master plus correctness) v1

Created attachment 15541 [details]
patch for Samba 4.10 (cherry-picked of security fix from master plus correctness) v1

While this will likely still require a CVE, it requires some unusual privilege to exploit, as the user doing the dirsync must have GET_CHANGES privilege, eg the permissions normally given to an RODC.  

Default users will not have this right.

I've scored it as: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (4.9)

Adam,

I'm writing up the CVE advisory text.  Can I credit you as the original reporter?

Is there an affiliation you would like to list? (typically a company you found it while working for).

Thanks!

Created attachment 15543 [details]
advisory with CVE (v1)

Created attachment 15544 [details]
revised CVE text with 4.11 mentioned (v2)

Created attachment 15545 [details]
CVE text with 4.11 and -M single (v3)

(In reply to Andrew Bartlett from comment #28)
of course you can.

Just as a status update:

I'm happy with this except I'm having trouble getting the 4.9 branch to pass CI on the private GitLab CI due to unrelated failures.  

If someone (else?) can get a good CI on 4.9 it I'm hoping we can include it in this or the next the security release.

Comment on attachment 15540 [details]
patch for Samba 4.9 (cherry-picked of security fix from master plus correctness) v1

CI of the Samba 4.9 patch passed on sn-devel for the 'samba' task and Gitlab CI for the rest.

Assigning to Karolin for the next available security release.

The version numbers in the advisory may need to be updated.

Planned release date: Tuesday, October 29
Opening bug report for vendors.

Samba 4.11.2, 4.10.10 and 4.9.15 have been shipped to address this defect.

Patch does not apply on current master:

Wende an: CVE-2019-14847 dsdb: Demonstrate the correct interaction of ranged_results style attributes and dirsync
Wende an: CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync
error: Anwendung des Patches fehlgeschlagen: source4/dsdb/samdb/ldb_modules/dirsync.c:1014
error: source4/dsdb/samdb/ldb_modules/dirsync.c: Patch konnte nicht angewendet werden
Anwendung des Patches fehlgeschlagen bei 0002 CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync

Pushed to v4-{11,10,9}-test.
Master still missing, patch does not apply.

(In reply to Karolin Seeger from comment #39)
Looks like intermediate changes created trouble.

I've rebased the patches and created a merge request.

As the release is now public I've marked the bug public also after checking the attachments and comments.  I've made the full backtrace private, we don't need that to be public.

Removing vendor alias now this is public.  If you (as a vendor) wish to still track this, please CC individually.

Thanks!

Patch for master landed as 03205663b3e5939896c1aad93c4a45cd769b06b4