diff -Nru samba-4.13.5+dfsg/debian/changelog samba-4.13.5+dfsg/debian/changelog --- samba-4.13.5+dfsg/debian/changelog 2021-03-13 08:31:27.000000000 +0100 +++ samba-4.13.5+dfsg/debian/changelog 2021-05-06 21:09:29.000000000 +0200 @@ -1,3 +1,11 @@ +samba (2:4.13.5+dfsg-2) unstable; urgency=high + + * CVE-2021-20254: Negative idmap cache entries can cause incorrect group + entries in the Samba file server process token (Closes: #987811) + * Add Breaks+Replaces: samba-dev (<< 2:4.11) (Closes: #987209) + + -- Mathieu Parent Thu, 06 May 2021 21:09:29 +0200 + samba (2:4.13.5+dfsg-1) unstable; urgency=medium * New upstream version (Closes: #984863) @@ -45,7 +53,7 @@ samba (2:4.13.2+dfsg-2) unstable; urgency=medium - * Upload to unstable + * Upload to unstable -- Mathieu Parent Wed, 18 Nov 2020 20:34:51 +0100 diff -Nru samba-4.13.5+dfsg/debian/control samba-4.13.5+dfsg/debian/control --- samba-4.13.5+dfsg/debian/control 2020-12-16 18:13:06.000000000 +0100 +++ samba-4.13.5+dfsg/debian/control 2021-05-06 21:09:29.000000000 +0200 @@ -421,7 +421,8 @@ Multi-Arch: same Depends: libwbclient0 (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends} Pre-Depends: dpkg (>= 1.15.6~) -Breaks: samba-libs (<< 2:4.11.0+dfsg-1~) +Breaks: samba-libs (<< 2:4.11.0+dfsg-1~), samba-dev (<< 2:4.11) +Replaces: samba-dev (<< 2:4.11) Description: Samba winbind client library - development files Samba is an implementation of the SMB/CIFS protocol for Unix systems, providing support for cross-platform file and printer sharing with diff -Nru samba-4.13.5+dfsg/debian/patches/CVE-2021-20254.patch samba-4.13.5+dfsg/debian/patches/CVE-2021-20254.patch --- samba-4.13.5+dfsg/debian/patches/CVE-2021-20254.patch 1970-01-01 01:00:00.000000000 +0100 +++ samba-4.13.5+dfsg/debian/patches/CVE-2021-20254.patch 2021-05-06 21:03:55.000000000 +0200 @@ -0,0 +1,235 @@ +From c5f31dbc3b8b86335769b9c84a0d09765cc33259 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Sat, 20 Feb 2021 15:50:12 +0100 +Subject: [PATCH] CVE-2021-20254 passdb: Simplify sids_to_unixids() + +Best reviewed with "git show -b", there's a "continue" statement that +changes subsequent indentation. + +Decouple lookup status of ids from ID_TYPE_NOT_SPECIFIED + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14571 + +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison + +(backported from patch from master) +[backport by npower@samba.org as master commit + 493f5d6b078e0b0f80d1ef25043e2834cb4fcb87 and + 58e9b62222ad62c81cdf11d704859a227cb2902b creates conflicts + due to rename of WBC_ID_TYPE_* -> ID_TYPE_*] +--- + source3/passdb/lookup_sid.c | 123 +++++++++++++++++++++++++++++------- + 1 file changed, 101 insertions(+), 22 deletions(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 82c47b3145b..4b3aa7e435d 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -29,6 +29,7 @@ + #include "../libcli/security/security.h" + #include "lib/winbind_util.h" + #include "../librpc/gen_ndr/idmap.h" ++#include "lib/util/bitmap.h" + + static bool lookup_unix_user_name(const char *name, struct dom_sid *sid) + { +@@ -1247,7 +1248,9 @@ bool sids_to_unixids(const struct dom_sid *sids, uint32_t num_sids, + { + struct wbcDomainSid *wbc_sids = NULL; + struct wbcUnixId *wbc_ids = NULL; ++ struct bitmap *found = NULL; + uint32_t i, num_not_cached; ++ uint32_t wbc_ids_size = 0; + wbcErr err; + bool ret = false; + +@@ -1255,6 +1258,20 @@ bool sids_to_unixids(const struct dom_sid *sids, uint32_t num_sids, + if (wbc_sids == NULL) { + return false; + } ++ found = bitmap_talloc(wbc_sids, num_sids); ++ if (found == NULL) { ++ goto fail; ++ } ++ ++ /* ++ * We go through the requested SID array three times. ++ * First time to look for global_sid_Unix_Users ++ * and global_sid_Unix_Groups SIDS, and to look ++ * for mappings cached in the idmap_cache. ++ * ++ * Use bitmap_set() to mark an ids[] array entry as ++ * being mapped. ++ */ + + num_not_cached = 0; + +@@ -1266,17 +1283,20 @@ bool sids_to_unixids(const struct dom_sid *sids, uint32_t num_sids, + &sids[i], &rid)) { + ids[i].type = ID_TYPE_UID; + ids[i].id = rid; ++ bitmap_set(found, i); + continue; + } + if (sid_peek_check_rid(&global_sid_Unix_Groups, + &sids[i], &rid)) { + ids[i].type = ID_TYPE_GID; + ids[i].id = rid; ++ bitmap_set(found, i); + continue; + } + if (idmap_cache_find_sid2unixid(&sids[i], &ids[i], &expired) + && !expired) + { ++ bitmap_set(found, i); + continue; + } + ids[i].type = ID_TYPE_NOT_SPECIFIED; +@@ -1287,62 +1307,121 @@ bool sids_to_unixids(const struct dom_sid *sids, uint32_t num_sids, + if (num_not_cached == 0) { + goto done; + } +- wbc_ids = talloc_array(talloc_tos(), struct wbcUnixId, num_not_cached); ++ ++ /* ++ * For the ones that we couldn't map in the loop above, query winbindd ++ * via wbcSidsToUnixIds(). ++ */ ++ ++ wbc_ids_size = num_not_cached; ++ wbc_ids = talloc_array(talloc_tos(), struct wbcUnixId, wbc_ids_size); + if (wbc_ids == NULL) { + goto fail; + } +- for (i=0; i id is a union anyway */ +- ids[i].type = (enum id_type)wbc_ids[num_not_cached].type; +- ids[i].id = wbc_ids[num_not_cached].id.gid; +- break; +- } +- num_not_cached += 1; ++ if (bitmap_query(found, i)) { ++ continue; + } ++ ++ SMB_ASSERT(num_not_cached < wbc_ids_size); ++ ++ switch (wbc_ids[num_not_cached].type) { ++ case WBC_ID_TYPE_UID: ++ ids[i].type = ID_TYPE_UID; ++ ids[i].id = wbc_ids[num_not_cached].id.uid; ++ bitmap_set(found, i); ++ break; ++ case WBC_ID_TYPE_GID: ++ ids[i].type = ID_TYPE_GID; ++ ids[i].id = wbc_ids[num_not_cached].id.gid; ++ bitmap_set(found, i); ++ break; ++ case WBC_ID_TYPE_BOTH: ++ ids[i].type = ID_TYPE_BOTH; ++ ids[i].id = wbc_ids[num_not_cached].id.uid; ++ bitmap_set(found, i); ++ break; ++ case WBC_ID_TYPE_NOT_SPECIFIED: ++ /* ++ * wbcSidsToUnixIds() wasn't able to map this ++ * so we still need to check legacy_sid_to_XXX() ++ * below. Don't mark the bitmap entry ++ * as being found so the final loop knows ++ * to try and map this entry. ++ */ ++ ids[i].type = ID_TYPE_NOT_SPECIFIED; ++ ids[i].id = (uint32_t)-1; ++ break; ++ default: ++ /* ++ * A successful return from wbcSidsToUnixIds() ++ * cannot return anything other than the values ++ * checked for above. Ensure this is so. ++ */ ++ smb_panic(__location__); ++ break; ++ } ++ num_not_cached += 1; + } + ++ /* ++ * Third and final time through the SID array, ++ * try legacy_sid_to_gid()/legacy_sid_to_uid() ++ * for entries we haven't already been able to ++ * map. ++ * ++ * Use bitmap_set() to mark an ids[] array entry as ++ * being mapped. ++ */ ++ + for (i=0; i