Bug 1949442 (CVE-2021-20254) - CVE-2021-20254 samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token
Summary: CVE-2021-20254 samba: Negative idmap cache entries can cause incorrect group ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20254
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1949444 1949445 1949446 1955027 1961208 2003505 2003506 2003507
Blocks: 1949448
TreeView+ depends on / blocked
 
Reported: 2021-04-14 10:01 UTC by Huzaifa S. Sidhpurwala
Modified: 2024-10-01 17:56 UTC (History)
19 users (show)

Fixed In Version: samba 4.14.4, samba 4.13.8, samba 4.12.15
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2021-06-09 03:04:01 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2313 0 None None None 2021-06-08 22:30:45 UTC
Red Hat Product Errata RHSA-2021:3723 0 None None None 2021-10-05 05:16:34 UTC
Red Hat Product Errata RHSA-2021:3724 0 None None None 2021-10-05 05:17:12 UTC
Red Hat Product Errata RHSA-2021:3988 0 None None None 2021-10-26 07:38:29 UTC
Red Hat Product Errata RHSA-2021:4058 0 None None None 2021-11-02 08:43:33 UTC
Red Hat Product Errata RHSA-2021:4866 0 None None None 2021-11-30 15:51:05 UTC

Description Huzaifa S. Sidhpurwala 2021-04-14 10:01:15 UTC 
As per upstream:

The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user.

Most commonly this flaw caused the calling code to crash, but an alert user (Peter Eriksson, IT Department, Linköping University) found this flaw by noticing an unprivileged user was able to delete a file within a network share that they should have been disallowed access to.

Analysis of the code paths has not allowed us to discover a way for a remote user to be able to trigger this flaw reproducibly or on demand, but this CVE has been issued out of an abundance of caution.
Comment 1 Huzaifa S. Sidhpurwala 2021-04-14 10:01:21 UTC 
Acknowledgments:

Name: the Samba project
Upstream: Peter Eriksson (IT Department, Linköping University)
Comment 3 Huzaifa S. Sidhpurwala 2021-04-29 09:50:42 UTC 
External References:

https://www.samba.org/samba/security/CVE-2021-20254.html
Comment 4 Huzaifa S. Sidhpurwala 2021-04-29 09:51:34 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1955027]
Comment 6 errata-xmlrpc 2021-06-08 22:30:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2313 https://access.redhat.com/errata/RHSA-2021:2313
Comment 7 Product Security DevOps Team 2021-06-09 03:04:01 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20254
Comment 9 errata-xmlrpc 2021-10-05 05:16:33 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 7

Via RHSA-2021:3723 https://access.redhat.com/errata/RHSA-2021:3723
Comment 10 errata-xmlrpc 2021-10-05 05:17:10 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 8

Via RHSA-2021:3724 https://access.redhat.com/errata/RHSA-2021:3724
Comment 11 errata-xmlrpc 2021-10-26 07:38:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support

Via RHSA-2021:3988 https://access.redhat.com/errata/RHSA-2021:3988
Comment 12 errata-xmlrpc 2021-11-02 08:43:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4058 https://access.redhat.com/errata/RHSA-2021:4058
Comment 13 errata-xmlrpc 2021-11-30 15:51:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:4866 https://access.redhat.com/errata/RHSA-2021:4866
Note You need to log in before you can comment on or make changes to this bug.