Bug 1941402 (CVE-2021-20277) - CVE-2021-20277 samba: Out of bounds read in AD DC LDAP server
Summary: CVE-2021-20277 samba: Out of bounds read in AD DC LDAP server
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20277
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1941516 1941511 1941512 1941513 1941514 1941515 1941517 1942497 1943149 1962752 1962753
Blocks: 1941401 1942875
TreeView+ depends on / blocked
 
Reported: 2021-03-22 05:18 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-07-20 21:23 UTC (History)
14 users (show)

Fixed In Version: samba 4.14.1, samba 4.13.6, samba 4.12.13
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-04-06 17:36:02 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2331 0 None None None 2021-06-08 22:04:16 UTC
Red Hat Product Errata RHSA-2021:2786 0 None None None 2021-07-20 21:23:59 UTC

Description Huzaifa S. Sidhpurwala 2021-03-22 05:18:09 UTC
As per upstream:

A string in an LDAP attribute that contains multiple consecutive leading spaces can lead to a memmove() of out of bounds memory in ldb_handler_fold().

ldb_handler_fold() is used by case insensitive strings - that is most string attributes - in Active Directory.

As the search expression is normalised prior to matching any potential objects this in turn may crash the LDAP server process handling the request.  It may be possible to leak the out of bounds memory by matching against it, but this is thought to be unlikely.

Comment 1 Huzaifa S. Sidhpurwala 2021-03-22 05:18:12 UTC
Acknowledgments:

Name: the Samba Project
Upstream: Douglas Bagnall (Catalyst and the Samba Team)

Comment 3 Guilherme de Almeida Suckevicz 2021-03-24 13:17:00 UTC
Created libldb tracking bugs for this issue:

Affects: fedora-all [bug 1942497]

Comment 4 Huzaifa S. Sidhpurwala 2021-03-24 13:52:32 UTC
External References:

https://www.samba.org/samba/security/CVE-2021-20277.html

Comment 8 Hardik Vyas 2021-03-26 13:52:34 UTC
Red Hat Gluster Storage 3 uses built-in version of ldb library in Samba:

$ cat samba.spec
[...]
# RHGS always builds with a private copy of ldb
%global with_internal_ldb 1
[...]
%if ! %with_internal_ldb
%global libldb_version 2.0.8

BuildRequires: libldb-devel >= %{libldb_version}
BuildRequires: python3-ldb-devel >= %{libldb_version}
%endif
[...]

Comment 9 Hardik Vyas 2021-03-26 13:52:43 UTC
Statement:

The version of Samba shipped with Red Hat Gluster Storage (RHGS) 3 is built with a private copy of ldb (LDAP-like embedded database) library which includes the vulnerable code. However, Samba shipped with RHGS 3 is not supported for use as an Active Directory Domain Controller and hence the impact has been lowered.

Comment 17 errata-xmlrpc 2021-04-06 10:34:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:1072 https://access.redhat.com/errata/RHSA-2021:1072

Comment 18 Product Security DevOps Team 2021-04-06 17:36:02 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20277

Comment 19 errata-xmlrpc 2021-04-14 15:10:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1197 https://access.redhat.com/errata/RHSA-2021:1197

Comment 20 errata-xmlrpc 2021-04-15 11:03:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:1214 https://access.redhat.com/errata/RHSA-2021:1214

Comment 21 errata-xmlrpc 2021-04-15 12:07:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:1213 https://access.redhat.com/errata/RHSA-2021:1213

Comment 23 errata-xmlrpc 2021-06-08 22:04:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:2331 https://access.redhat.com/errata/RHSA-2021:2331

Comment 24 errata-xmlrpc 2021-07-20 21:24:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support

Via RHSA-2021:2786 https://access.redhat.com/errata/RHSA-2021:2786


Note You need to log in before you can comment on or make changes to this bug.