Bug 1949442 (CVE-2021-20254)

Summary:	CVE-2021-20254 samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abokovoy, anoopcs, asn, chorn, dkarpele, gdeschner, hvyas, iboukris, jarrpa, jstephen, lmohanty, madam, mvanderw, puebele, rhs-smb, sbose, security-response-team, ssorce, unixops
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.14.4, samba 4.13.8, samba 4.12.15	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-09 03:04:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1949444, 1949445, 1949446, 1955027, 1961208, 2003505, 2003506, 2003507
Bug Blocks:	1949448

Description Huzaifa S. Sidhpurwala 2021-04-14 10:01:15 UTC

As per upstream:

The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user.

Most commonly this flaw caused the calling code to crash, but an alert user (Peter Eriksson, IT Department, Linköping University) found this flaw by noticing an unprivileged user was able to delete a file within a network share that they should have been disallowed access to.

Analysis of the code paths has not allowed us to discover a way for a remote user to be able to trigger this flaw reproducibly or on demand, but this CVE has been issued out of an abundance of caution.

Comment 1 Huzaifa S. Sidhpurwala 2021-04-14 10:01:21 UTC

Acknowledgments:

Name: the Samba project
Upstream: Peter Eriksson (IT Department, Linköping University)

Comment 3 Huzaifa S. Sidhpurwala 2021-04-29 09:50:42 UTC

External References:

https://www.samba.org/samba/security/CVE-2021-20254.html

Comment 4 Huzaifa S. Sidhpurwala 2021-04-29 09:51:34 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1955027]

Comment 6 errata-xmlrpc 2021-06-08 22:30:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2313 https://access.redhat.com/errata/RHSA-2021:2313

Comment 7 Product Security DevOps Team 2021-06-09 03:04:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20254

Comment 9 errata-xmlrpc 2021-10-05 05:16:33 UTC

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 7

Via RHSA-2021:3723 https://access.redhat.com/errata/RHSA-2021:3723

Comment 10 errata-xmlrpc 2021-10-05 05:17:10 UTC

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 8

Via RHSA-2021:3724 https://access.redhat.com/errata/RHSA-2021:3724

Comment 11 errata-xmlrpc 2021-10-26 07:38:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support

Via RHSA-2021:3988 https://access.redhat.com/errata/RHSA-2021:3988

Comment 12 errata-xmlrpc 2021-11-02 08:43:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4058 https://access.redhat.com/errata/RHSA-2021:4058

Comment 13 errata-xmlrpc 2021-11-30 15:51:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:4866 https://access.redhat.com/errata/RHSA-2021:4866