Bug 15992 (CVE-2026-1933) - CVE-2026-1933 [SECURITY] Missing access check on reparse point operations
Summary: CVE-2026-1933 [SECURITY] Missing access check on reparse point operations
Status: RESOLVED FIXED
Alias: CVE-2026-1933
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba release manager
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks: 16018
  Show dependency treegraph
 
Reported: 2026-02-04 09:02 UTC by Volker Lendecke
Modified: 2026-05-26 14:11 UTC (History)
3 users (show)

See Also:


Attachments
Patch for master (1.55 KB, patch)
2026-02-05 10:11 UTC, Volker Lendecke
metze: review-
Details
Patch for 4.24 (1.55 KB, patch)
2026-02-05 10:21 UTC, Volker Lendecke
no flags Details
Patch for 4.23 (1.55 KB, patch)
2026-02-05 10:21 UTC, Volker Lendecke
no flags Details
Patch for 4.22 (1.55 KB, patch)
2026-02-05 10:22 UTC, Volker Lendecke
no flags Details
CVE advisory (2.42 KB, text/plain)
2026-02-05 10:50 UTC, Volker Lendecke
metze: review-
Details
Next version, it's a CVSS 7.1 (High) (2.84 KB, text/plain)
2026-02-05 19:36 UTC, Volker Lendecke
metze: review+
Details
Patch for master (3.46 KB, patch)
2026-02-06 09:44 UTC, Volker Lendecke
metze: review+
vl: ci-passed+
Details
Patch for 4.24 (3.46 KB, patch)
2026-02-06 10:48 UTC, Volker Lendecke
metze: review+
vl: ci-passed+
Details
Patch for 4.23 (3.46 KB, patch)
2026-02-06 12:48 UTC, Volker Lendecke
metze: review+
vl: ci-passed+
Details
Patch for 4.22 (3.46 KB, patch)
2026-02-06 14:24 UTC, Volker Lendecke
metze: review+
vl: ci-passed+
Details
Patch for 4.21 (3.39 KB, patch)
2026-02-06 15:43 UTC, Volker Lendecke
metze: review+
vl: ci-passed+
Details
Changed advisory workaround wording (2.87 KB, text/plain)
2026-02-09 08:28 UTC, Volker Lendecke
metze: review+
Details
Patch without WIP: and with Reviewed-by: tags (3.54 KB, patch)
2026-02-09 19:20 UTC, Volker Lendecke
metze: review+
Details
Patch for v4.21 with reviewed-by, without WIP: (3.47 KB, patch)
2026-03-10 22:28 UTC, Douglas Bagnall
metze: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Volker Lendecke 2026-02-04 09:02:41 UTC

    
Comment 1 Volker Lendecke 2026-02-05 10:11:28 UTC
Created attachment 18825 [details]
Patch for master
Comment 2 Volker Lendecke 2026-02-05 10:21:17 UTC
Created attachment 18826 [details]
Patch for 4.24
Comment 3 Volker Lendecke 2026-02-05 10:21:44 UTC
Created attachment 18827 [details]
Patch for 4.23
Comment 4 Volker Lendecke 2026-02-05 10:22:32 UTC
Created attachment 18828 [details]
Patch for 4.22
Comment 5 Volker Lendecke 2026-02-05 10:50:48 UTC
Created attachment 18829 [details]
CVE advisory
Comment 6 Stefan Metzmacher 2026-02-05 12:25:07 UTC
Comment on attachment 18829 [details]
CVE advisory

The test looks good.

I'd give it

Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Score: 4.9 (Medium)

instead of

Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Score: 4.3 (Medium)

The difference are:
 
Privileges Required (PR) is high,
as the user needs to have write permissions to
the unix filesystem, which a typical read-only share
doesn't have.

Integrity Impact (I) is high,
as the attacker may redirect the user to a different
file controlled by the attacker.
And the attacker is able to block access to the file
content.
Comment 7 Stefan Metzmacher 2026-02-05 12:25:20 UTC
Comment on attachment 18825 [details]
Patch for master

Both MS-FSA 2.1.5.10.3 FSCTL_DELETE_REPARSE_POINT and
2.1.5.10.37 FSCTL_SET_REPARSE_POINT have this:

- If (Open.GrantedAccess & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES)) == 0, the
  operation MUST be failed with STATUS_ACCESS_DENIED.
- If Open.File.Volume.IsReadOnly is TRUE, the operation MUST be failed with
  STATUS_MEDIA_WRITE_PROTECTED.

I don't this we need STATUS_MEDIA_WRITE_PROTECTED,
as rejected_share_access = access_mask & ~(fsp->conn->share_access)
in smbd_calculate_access_mask_fsp() should already deny any open
with FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES, see create_share_access_mask()

But I guess in order to pass the existing tests
the check needs to allow FILE_WRITE_ATTRIBUTES.

I guess this heck would do what we need:

if (fsp->fsp_name->twrp != 0 ||
    !(fsp->access_mask & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES)))
{

Maybe the twrp check may not be needed, but it feels better this
way until we have explicit tests for the condition.
Comment 8 Stefan Metzmacher 2026-02-05 12:26:11 UTC
And 4.21 still gets security fixes as 4.24.0 is not released yet
Comment 9 Volker Lendecke 2026-02-05 13:15:24 UTC
Unfortunately the patches break the build, so more work is needed.
Comment 10 Volker Lendecke 2026-02-05 15:10:34 UTC
(In reply to Stefan Metzmacher from comment #6)

> Privileges Required (PR) is high,
> as the user needs to have write permissions to
> the unix filesystem, which a typical read-only share
> doesn't have.
> 
> Integrity Impact (I) is high,
> as the attacker may redirect the user to a different
> file controlled by the attacker.
> And the attacker is able to block access to the file
> content.

With your additional insight that an attacker can easily make an entire file system at least temporarily unavailable, I end up at

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Overall CVSS Score: 7.1

I leave PR at low, because my understanding is that PR:H means the attacker needs admin privileges whereas PR:L means normal user privs.
Comment 11 Volker Lendecke 2026-02-05 19:36:25 UTC
Created attachment 18830 [details]
Next version, it's a CVSS 7.1 (High)
Comment 12 Volker Lendecke 2026-02-06 09:44:29 UTC
Created attachment 18831 [details]
Patch for master
Comment 13 Volker Lendecke 2026-02-06 10:48:59 UTC
Created attachment 18833 [details]
Patch for 4.24
Comment 14 Volker Lendecke 2026-02-06 12:48:49 UTC
Created attachment 18835 [details]
Patch for 4.23
Comment 15 Stefan Metzmacher 2026-02-06 13:19:52 UTC
Comment on attachment 18830 [details]
Next version, it's a CVSS 7.1 (High)

Looks good thanks!
Comment 16 Stefan Metzmacher 2026-02-06 13:25:23 UTC
Comment on attachment 18831 [details]
Patch for master

The changes look good, thanks! They get a review+ when the 'WIP:' is removed.
Comment 17 Ralph Böhme 2026-02-06 13:34:19 UTC
(In reply to Stefan Metzmacher from comment #16)
Use check_any_access_fsp()? What about other ioctls? Any others maybe missing the access check?
Comment 18 Stefan Metzmacher 2026-02-06 13:39:04 UTC
(In reply to Ralph Böhme from comment #17)

I knew we had some helper function, but I couldn't find it.

I guess check_any_access_fsp() is exactly what we want :-)
Comment 19 Stefan Metzmacher 2026-02-06 13:47:19 UTC
(In reply to Stefan Metzmacher from comment #18)

source3/smbd/smb2_ioctl_filesys.c already has some check_any_access_fsp()
calls.

Maybe it would be good move the checks there in order
to avoid future problems if other vfs modules want to implement
reparse points. But that can be done as cleanup after a security
release.
Comment 20 Stefan Metzmacher 2026-02-06 13:48:36 UTC
(In reply to Stefan Metzmacher from comment #19)

Even the use of check_any_access_fsp() could be a future cleanup fix,
as a security fix the current fix seems to be enough.
Comment 21 Volker Lendecke 2026-02-06 14:24:25 UTC
Created attachment 18836 [details]
Patch for 4.22
Comment 22 Volker Lendecke 2026-02-06 15:43:26 UTC
Created attachment 18837 [details]
Patch for 4.21
Comment 23 Volker Lendecke 2026-02-09 08:28:34 UTC
Created attachment 18838 [details]
Changed advisory workaround wording
Comment 24 Volker Lendecke 2026-02-09 19:20:51 UTC
Created attachment 18839 [details]
Patch without WIP: and with Reviewed-by: tags

The attached patch is functionally the same, it applies to all affected branches. Only for 4.21 "git am -3" has to slightly massage the line numbers. If needed and as mandated by the security process, I can upload individual ones.
Comment 25 Volker Lendecke 2026-02-09 19:21:41 UTC
Handing over to the release account for further security release processing.
Comment 26 Volker Lendecke 2026-02-11 14:06:23 UTC
Adding original bug reporter for review
Comment 27 Asim Viladi Oglu Manizada 2026-02-16 06:58:09 UTC
Hi folks, thanks for adding me here. I've re-validated the patch and confirmed it works as intended; the writeup looks good as well. I appreciate your callout of the higher severity -- I had not appreciated the full consequences of the issue. 

Good to proceed on my end! Thanks
Comment 28 Stefan Metzmacher 2026-02-18 15:56:02 UTC
Comment on attachment 18839 [details]
Patch without WIP: and with Reviewed-by: tags

Björn, please use this for all branches, the others are there
to show ci passed
Comment 29 Björn Jacke 2026-02-19 21:35:16 UTC
scheduled release date for the security releases is 2026-03-05
Comment 30 Asim Viladi Oglu Manizada 2026-03-05 17:11:19 UTC
hey all, just checking if 3/5 is still the target or if the date has changed. Thanks
Comment 31 Björn Jacke 2026-03-06 13:00:53 UTC
release date was postponed because there are other security fixes that are supposed to get fixed with the same sec release.
Comment 32 Asim Viladi Oglu Manizada 2026-03-07 06:33:00 UTC
Ack, thanks Björn! Do you have a new target date in mind already, or is it up in the air?
Comment 33 Douglas Bagnall 2026-03-10 22:28:53 UTC
Created attachment 18883 [details]
Patch for v4.21 with reviewed-by, without WIP:

v4-21 patch is slightly different.
Comment 34 Asim Viladi Oglu Manizada 2026-03-18 00:52:59 UTC
Hi folks, just wanted to check once more if you had a new target date in mind -- no rush *at all*, just wanted to include this finding into a writeup of mine at some point, so want to align on dates. Apologies if this is answered by the linked issues, unfortunately I can't see them.
Comment 35 Björn Jacke 2026-03-18 13:23:10 UTC
we have more security releaste fixes in the pipe, which we queue into the next sec release. I expect in about 2 weeks we'll be able to make a release for all those issues.
Comment 36 Björn Jacke 2026-04-08 16:34:57 UTC
the security release that was scheduled for tomorrow, will be postponed due to
new problems that have been identified with one of the fixes.

We will announce a new release date as soon as possible after the remaining
issues have been ruled out.
Comment 37 Asim Viladi Oglu Manizada 2026-04-22 23:00:13 UTC
Hi Björn, thanks for the heads up. Do you have a rough date for the release in mind?
Comment 38 Björn Jacke 2026-04-23 07:46:29 UTC
(In reply to Asim Viladi Oglu Manizada from comment #37)
as soon as we can oversee that the fixes for the vulnerabilities are in good shape, we set a date and the release date will be published then. There is no estimated release date we can tell you in advance until the patches are ready. The announcement will be made here and in all the related bug reports and on the mailing lists then.
Comment 39 Björn Jacke 2026-05-15 13:02:24 UTC
Scheduled release date is now 2026-05-26.
Comment 40 Stefan Metzmacher 2026-05-26 09:15:42 UTC
I plan to upload the releases in about 3 hours from now...
Comment 41 Samba QA Contact 2026-05-26 12:35:31 UTC
This bug was referenced in samba v4-24-stable (Release samba-4.24.3):

ffbccc5d9f08469f42932db595c7eb886d9064bd
a53a86e1167d76cfc0c051a50b5f372afc78b721
Comment 42 Samba QA Contact 2026-05-26 12:36:03 UTC
This bug was referenced in samba v4-23-stable (Release samba-4.23.8):

39856d437502dfd7e80ac2d6a1690e45b636056e
7443fb5ad3f7efe4d9061320c29dbbfd636a41af
Comment 43 Samba QA Contact 2026-05-26 12:36:32 UTC
This bug was referenced in samba v4-22-stable (Release samba-4.22.10):

024c0f6e511f0b477f5dd2582f03ac0f44f011d1
a0e66dbfc549b7b3daea5b82a626dda5810ec764
Comment 44 Samba QA Contact 2026-05-26 12:38:36 UTC
This bug was referenced in samba v4-24-test (Release samba-4.24.3):

ffbccc5d9f08469f42932db595c7eb886d9064bd
a53a86e1167d76cfc0c051a50b5f372afc78b721
Comment 45 Samba QA Contact 2026-05-26 12:39:26 UTC
This bug was referenced in samba v4-23-test (Release samba-4.23.8):

39856d437502dfd7e80ac2d6a1690e45b636056e
7443fb5ad3f7efe4d9061320c29dbbfd636a41af
Comment 46 Samba QA Contact 2026-05-26 12:40:19 UTC
This bug was referenced in samba v4-22-test (Release samba-4.22.10):

024c0f6e511f0b477f5dd2582f03ac0f44f011d1
a0e66dbfc549b7b3daea5b82a626dda5810ec764
Comment 47 Samba QA Contact 2026-05-26 13:55:05 UTC
This bug was referenced in samba master:

fb8ef1c97e1ce36d633b46cf10ff48aa70c2ed4c
6c7f7c40029b9d34b1ede83391cc451a483cf1d2