Created attachment 18926 [details] Findings as reported
Mail by Kevin Valerio <kevin.valerio@trailofbits.com>: Hi, We're writing from Trail of Bits, a security research firm. We found a security issue in Samba and have prepared a patch for it. The finding is rated Medium. Details are below. FINDINGS -------- In ndr_push_compression_mszip_cab_chunk() at ndr_compression.c:230, the zlib deflate output buffer size is set to comp_chunk.length instead of comp_chunk.length - 2, failing to account for the 2-byte "CK" header already written at the start of the buffer. This allows deflate() to write up to 2 bytes past the end of the allocated heap buffer when compressing CAB data for NDR serialization. An attacker who can cause a Samba server to re-serialize attacker- influenced CAB data (e.g., via printer driver uploads) can trigger the overflow. The resulting 2-byte heap overflow can corrupt adjacent heap objects or talloc metadata. REPRODUCTION ------------ Build fuzzers: git clone https://github.com/google/oss-fuzz cd oss-fuzz python3 infra/helper.py build_fuzzers --sanitizer address samba Run the PoC: python3 infra/helper.py reproduce samba fuzz_ndr_cab_TYPE_STRUCT poc.bin Expected output: ASAN reports heap-buffer-overflow WRITE in ndr_push_compression_mszip_cab_chunk at ndr_compression.c:255, with the overflow occurring immediately past a ~32K heap region. ATTACHMENTS ----------- We have attached a zip containing: - Full technical details of each finding - Reproduction steps and proof-of-concept where applicable - Candidate patch(es) with regression tests BACKGROUND ---------- Anthropic is conducting research into the use of large language models for automated vulnerability discovery in open source software. As part of that work, Anthropic used Claude to scan a set of widely used open source projects for security issues. Anthropic then engaged Trail of Bits to independently triage, manually validate, and develop patches for the findings. Each issue in this report has been reviewed and confirmed by human security researchers at Trail of Bits. NEXT STEPS ---------- We are disclosing under Anthropic's coordinated vulnerability disclosure policy: https://www.anthropic.com/coordinated-vulnerability-disclosure Our disclosure timeline is 90 days from the date of this email, with a 14-day extension available if needed. We'd like to work with your maintainers to get these issues fixed. We are happy to submit PRs or coordinate with your preferred process. Let us know if there's a specific security contact you'd like us to work with. Thanks for your work on Samba. — Trail of Bits, in collaboration with Anthropic
(In reply to Volker Lendecke from comment #2) > Our disclosure timeline is 90 days from the date of this email, with a 14-day extension available if needed. That date was: > Date: Fri, 20 Mar 2026 12:40:46 +0100 So the deadline is about June 18.
I'm not aware of a call path to this code, outside smbtorture, so unless someone can find one I think we should open this up and just fix it.
(In reply to Andrew Bartlett from comment #4) Yes, it seems to be smbtorture only.
That's needed for supporting v4 printer drivers but we never finished that work. That is all unwired code.
Removing embargo.