In a configuration where acl_xattr vfs module is used on top of a standard local(ext4) filesystem, smb2.session.reauth4 which used to fail earlier(expected) is now successfully completed. [local-share] comment = For samba share of local EXT4 path = /mnt/ext4 read only = No vfs objects = acl_xattr acl_xattr:security_acl_name = user.NTACL See attachment for the `testparm -s` output. Expected behaviour: # smbtorture \\\\192.168.122.11\\local-share -U root%smb --target=samba3 smb2.session.reauth4 smbtorture 4.22.0pre1-GIT-5e278a52646 Using seed 1724928319 time: 2024-08-29 10:45:19.471919 test: reauth4 time: 2024-08-29 10:45:19.472824 time: 2024-08-29 10:45:19.526290 failure: reauth4 [ ../../source4/torture/smb2/session.c:603: status was NT_STATUS_ACCESS_DENIED, expected NT_STATUS_OK: smb2_setinfo_file failed ] Additional notes: I did a `git bisect` to only find the commit which introduced the regression as below: # git bisect good 630f1228d17c282a3661de050801b3aaf642accf is the first bad commit commit 630f1228d17c282a3661de050801b3aaf642accf Author: Ralph Boehme <slow@samba.org> Date: Tue Jan 23 15:19:12 2024 +0100 smbd: move target code out of loop body Reduces indentation of the code code that is run in this function and prepares for adding more of it. Review with: git show -w Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> source3/smbd/conn.c | 64 ++++++++++++++++++++++++++++++++++------------------------------ 1 file changed, 34 insertions(+), 30 deletions(-)
Created attachment 18431 [details] wip-fix.diff After an offline discussion, Ralph came up with a possible fix as attached.
Created attachment 18432 [details] testparm_s
Comment on attachment 18431 [details] wip-fix.diff This look good, sorry for not catching this. At least for SMB2/3 I think the impact is basically, similar to an NTLMSSP session that doesn't expire after 10 hours (the ticket liftime). But for systems with disabled ntlmssp (e.g. maybe for protected users) it might be a problem if a user was removed from a group...
(In reply to Stefan Metzmacher from comment #3) If so in what direction are we planning to take this forward? Should we ask for a CVE number? Or merge the suggested fix as it is?
Please note that the "bad commit" as per git bisect is already part of v4.21 branch.
(In reply to Stefan Metzmacher from comment #3) I tried to calculate the CVE score and got this: https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:I/V:C/RE:L CVSS v4.0 Score: 7 I find it hard though to imagine how this could be used by an attacker in a real world scenario.
(In reply to Ralph Böhme from comment #6) On the AD side, our threshold for fixes without embargo/CVE has been hovering around CVSS 5. But real-world exploitability does come into it of course.
Do we have a consensus on categorizing this bug report as CVE?
I've discussed this with Stefan and our proposal would be to request and assing a CVE, but not do a security release. @Anoop: can you drive the process as outlined in doc/releases/security_releases.txt in the team repo? We'll need a CVE, an advisory, a patch and backports.
(In reply to Ralph Böhme from comment #9) Ok, I'll go through it and start with the steps.
Created attachment 18526 [details] Advisory (draft)
Created attachment 18606 [details] Advisory CVE-2025-0620 v1 Updated advisory.
Created attachment 18607 [details] Advisory CVE-2025-0620 v2
So we're thinking this will come out as a normal Samba 4.21.x or 4.22.x on the release schedule, and turn up in master about the same time, then in the other affected release a few weeks later when that release is due?
(In reply to Douglas Bagnall from comment #14) Yes, that's what I expect to be the release flow here (even though we don't do a special full fledged release). Ralph, Can you please format the diff attached as a patch to get it merged?
Created attachment 18644 [details] Patch for 4.21
Created attachment 18645 [details] Patch for 4.22
Created attachment 18646 [details] Patch for master
Pushed to master and autobuild-v4-{22,21}-test. Missing tags added.
This bug was referenced in samba master: 6f0ae60428a024b4aba92a8103a698c1eca2357c
This bug was referenced in samba v4-21-test: bb4d8d322c2c7bda2cb245e60c423920ec5fa167
This bug was referenced in samba v4-21-stable (Release samba-4.21.6): bb4d8d322c2c7bda2cb245e60c423920ec5fa167
Open bug after the 4.21 release.
This bug was referenced in samba v4-22-test: baea767285800bc96e2e965741ac4dc4377c9f32
This bug was referenced in samba v4-22-stable (Release samba-4.22.2): baea767285800bc96e2e965741ac4dc4377c9f32
Closing out bug report. Thanks!