012-patch-cve-2015-5299.patch 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. From 8e49de7754f7171a58a1f94dee0f1138dbee3c60 Mon Sep 17 00:00:00 2001
  2. From: Jeremy Allison <jra@samba.org>
  3. Date: Fri, 23 Oct 2015 14:54:31 -0700
  4. Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on
  5. snapdir
  6. Fix originally from <partha@exablox.com>
  7. https://bugzilla.samba.org/show_bug.cgi?id=11529
  8. Signed-off-by: Jeremy Allison <jra@samba.org>
  9. Reviewed-by: David Disseldorp <ddiss@samba.org>
  10. ---
  11. source3/modules/vfs_shadow_copy2.c | 47 ++++++++++++++++++++++++++++++++++++++
  12. 1 file changed, 47 insertions(+)
  13. --- a/source3/modules/vfs_shadow_copy2.c
  14. +++ b/source3/modules/vfs_shadow_copy2.c
  15. @@ -21,6 +21,8 @@
  16. #include "includes.h"
  17. #include "smbd/smbd.h"
  18. +#include "smbd/globals.h"
  19. +#include "../libcli/security/security.h"
  20. #include "system/filesys.h"
  21. #include "ntioctl.h"
  22. @@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle
  23. SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1);
  24. }
  25. +static bool check_access_snapdir(struct vfs_handle_struct *handle,
  26. + const char *path)
  27. +{
  28. + struct smb_filename smb_fname;
  29. + int ret;
  30. + NTSTATUS status;
  31. + uint32_t access_granted = 0;
  32. +
  33. + ZERO_STRUCT(smb_fname);
  34. + smb_fname.base_name = talloc_asprintf(talloc_tos(),
  35. + "%s",
  36. + path);
  37. + if (smb_fname.base_name == NULL) {
  38. + return false;
  39. + }
  40. +
  41. + ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
  42. + if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
  43. + TALLOC_FREE(smb_fname.base_name);
  44. + return false;
  45. + }
  46. +
  47. + status = smbd_check_open_rights(handle->conn,
  48. + &smb_fname,
  49. + SEC_DIR_LIST,
  50. + &access_granted);
  51. + if (!NT_STATUS_IS_OK(status)) {
  52. + DEBUG(0,("user does not have list permission "
  53. + "on snapdir %s\n",
  54. + smb_fname.base_name));
  55. + TALLOC_FREE(smb_fname.base_name);
  56. + return false;
  57. + }
  58. + TALLOC_FREE(smb_fname.base_name);
  59. + return true;
  60. +}
  61. +
  62. static int shadow_copy2_rmdir(vfs_handle_struct *handle, const char *fname)
  63. {
  64. SHADOW2_NEXT(RMDIR, (handle, name), int, -1);
  65. @@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2
  66. SMB_STRUCT_DIRENT *d;
  67. TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
  68. char *snapshot;
  69. + bool ret;
  70. snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
  71. if (snapdir == NULL) {
  72. @@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2
  73. talloc_free(tmp_ctx);
  74. return -1;
  75. }
  76. + ret = check_access_snapdir(handle, snapdir);
  77. + if (!ret) {
  78. + DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
  79. + errno = EACCES;
  80. + talloc_free(tmp_ctx);
  81. + return -1;
  82. + }
  83. p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);