From ea86e8686f6c3945239cc9f9d9573b31ac6e2f9c Mon Sep 17 00:00:00 2001 From: xinghe Date: Fri, 11 Nov 2022 03:12:37 +0000 Subject: [PATCH] fix CVE-2021-20251 --- backport-0001-CVE-2021-20251.patch | 130 ++++++++ backport-0002-CVE-2021-20251.patch | 90 ++++++ backport-0003-CVE-2021-20251.patch | 99 ++++++ backport-0004-CVE-2021-20251.patch | 105 +++++++ backport-0005-CVE-2021-20251.patch | 264 ++++++++++++++++ backport-0006-CVE-2021-20251.patch | 124 ++++++++ backport-0007-CVE-2021-20251.patch | 57 ++++ backport-0008-CVE-2021-20251.patch | 485 +++++++++++++++++++++++++++++ backport-0009-CVE-2021-20251.patch | 34 ++ backport-0010-CVE-2021-20251.patch | 36 +++ backport-0011-CVE-2021-20251.patch | 198 ++++++++++++ backport-0012-CVE-2021-20251.patch | 60 ++++ backport-0013-CVE-2021-20251.patch | 115 +++++++ backport-0014-CVE-2021-20251.patch | 43 +++ backport-0015-CVE-2021-20251.patch | 91 ++++++ backport-0016-CVE-2021-20251.patch | 93 ++++++ backport-0017-CVE-2021-20251.patch | 42 +++ backport-0018-CVE-2021-20251.patch | 43 +++ backport-0019-CVE-2021-20251.patch | 135 ++++++++ backport-0020-CVE-2021-20251.patch | 160 ++++++++++ backport-0021-CVE-2021-20251.patch | 53 ++++ backport-0022-CVE-2021-20251.patch | 34 ++ backport-0023-CVE-2021-20251.patch | 45 +++ backport-0024-CVE-2021-20251.patch | 58 ++++ backport-0025-CVE-2021-20251.patch | 176 +++++++++++ backport-0026-CVE-2021-20251.patch | 264 ++++++++++++++++ backport-0027-CVE-2021-20251.patch | 106 +++++++ backport-0028-CVE-2021-20251.patch | 58 ++++ backport-0029-CVE-2021-20251.patch | 41 +++ samba.spec | 37 ++- 30 files changed, 3275 insertions(+), 1 deletion(-) create mode 100644 backport-0001-CVE-2021-20251.patch create mode 100644 backport-0002-CVE-2021-20251.patch create mode 100644 backport-0003-CVE-2021-20251.patch create mode 100644 backport-0004-CVE-2021-20251.patch create mode 100644 backport-0005-CVE-2021-20251.patch create mode 100644 backport-0006-CVE-2021-20251.patch create mode 100644 backport-0007-CVE-2021-20251.patch create mode 100644 backport-0008-CVE-2021-20251.patch create mode 100644 backport-0009-CVE-2021-20251.patch create mode 100644 backport-0010-CVE-2021-20251.patch create mode 100644 backport-0011-CVE-2021-20251.patch create mode 100644 backport-0012-CVE-2021-20251.patch create mode 100644 backport-0013-CVE-2021-20251.patch create mode 100644 backport-0014-CVE-2021-20251.patch create mode 100644 backport-0015-CVE-2021-20251.patch create mode 100644 backport-0016-CVE-2021-20251.patch create mode 100644 backport-0017-CVE-2021-20251.patch create mode 100644 backport-0018-CVE-2021-20251.patch create mode 100644 backport-0019-CVE-2021-20251.patch create mode 100644 backport-0020-CVE-2021-20251.patch create mode 100644 backport-0021-CVE-2021-20251.patch create mode 100644 backport-0022-CVE-2021-20251.patch create mode 100644 backport-0023-CVE-2021-20251.patch create mode 100644 backport-0024-CVE-2021-20251.patch create mode 100644 backport-0025-CVE-2021-20251.patch create mode 100644 backport-0026-CVE-2021-20251.patch create mode 100644 backport-0027-CVE-2021-20251.patch create mode 100644 backport-0028-CVE-2021-20251.patch create mode 100644 backport-0029-CVE-2021-20251.patch diff --git a/backport-0001-CVE-2021-20251.patch b/backport-0001-CVE-2021-20251.patch new file mode 100644 index 0000000..5c6b84a --- /dev/null +++ b/backport-0001-CVE-2021-20251.patch @@ -0,0 +1,130 @@ +From 628f97b24bd228aca409f5e142d8ab34e6421c7b Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Wed, 6 Jul 2022 15:36:26 +1200 +Subject: [PATCH 03/37] CVE-2021-20251 lib:crypto: Add des_crypt_blob_16() for + encrypting data with DES + +This lets us access single-DES from Python. This function is used in a +following commit for encrypting an NT hash to obtain the verifier for a +SAMR password change. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit b27a67af0216811d330d8a4c52390cf4fc04b5fd) + +[jsutton@samba.org Fixed wscript conflict introduced by commit + 61aeb7740764b202db0ddba559e83c3b2953ae36] + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + lib/crypto/py_crypto.c | 65 ++++++++++++++++++++++++++++++++++++++++ + lib/crypto/wscript_build | 2 +- + 2 files changed, 66 insertions(+), 1 deletion(-) + +diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c +index ad18d3ada0f..6753d3d8e9c 100644 +--- a/lib/crypto/py_crypto.c ++++ b/lib/crypto/py_crypto.c +@@ -25,6 +25,7 @@ + #include + #include + #include "lib/crypto/gnutls_helpers.h" ++#include "libcli/auth/libcli_auth.h" + + static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) + { +@@ -100,13 +101,77 @@ static PyObject *py_crypto_set_strict_mode(PyObject *module) + Py_RETURN_NONE; + } + ++static PyObject *py_crypto_des_crypt_blob_16(PyObject *self, PyObject *args) ++{ ++ PyObject *py_data = NULL; ++ uint8_t *data = NULL; ++ Py_ssize_t data_size; ++ ++ PyObject *py_key = NULL; ++ uint8_t *key = NULL; ++ Py_ssize_t key_size; ++ ++ uint8_t result[16]; ++ ++ bool ok; ++ int ret; ++ ++ ok = PyArg_ParseTuple(args, "SS", ++ &py_data, &py_key); ++ if (!ok) { ++ return NULL; ++ } ++ ++ ret = PyBytes_AsStringAndSize(py_data, ++ (char **)&data, ++ &data_size); ++ if (ret != 0) { ++ return NULL; ++ } ++ ++ ret = PyBytes_AsStringAndSize(py_key, ++ (char **)&key, ++ &key_size); ++ if (ret != 0) { ++ return NULL; ++ } ++ ++ if (data_size != 16) { ++ return PyErr_Format(PyExc_ValueError, ++ "Expected data size of 16 bytes; got %zd", ++ data_size); ++ } ++ ++ if (key_size != 14) { ++ return PyErr_Format(PyExc_ValueError, ++ "Expected key size of 14 bytes; got %zd", ++ key_size); ++ } ++ ++ ret = des_crypt112_16(result, data, key, ++ SAMBA_GNUTLS_ENCRYPT); ++ if (ret != 0) { ++ return PyErr_Format(PyExc_RuntimeError, ++ "des_crypt112_16() failed: %d", ++ ret); ++ } ++ ++ return PyBytes_FromStringAndSize((const char *)result, ++ sizeof(result)); ++} ++ + static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n" + "Encrypt the data with RC4 algorithm using the key"; + ++static const char py_crypto_des_crypt_blob_16_doc[] = "des_crypt_blob_16(data, key) -> bytes\n" ++ "Encrypt the 16-byte data with DES using " ++ "the 14-byte key"; ++ + static PyMethodDef py_crypto_methods[] = { + { "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc }, + { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" }, + { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" }, ++ { "des_crypt_blob_16", (PyCFunction)py_crypto_des_crypt_blob_16, METH_VARARGS, py_crypto_des_crypt_blob_16_doc }, + {0}, + }; + +diff --git a/lib/crypto/wscript_build b/lib/crypto/wscript_build +index e5766042541..0d5b548e7f8 100644 +--- a/lib/crypto/wscript_build ++++ b/lib/crypto/wscript_build +@@ -50,5 +50,5 @@ bld.SAMBA_SUBSYSTEM('TORTURE_LIBCRYPTO', + + bld.SAMBA_PYTHON('python_crypto', + source='py_crypto.c', +- deps='gnutls talloc', ++ deps='gnutls talloc LIBCLI_AUTH', + realname='samba/crypto.so') +-- +2.35.0 diff --git a/backport-0002-CVE-2021-20251.patch b/backport-0002-CVE-2021-20251.patch new file mode 100644 index 0000000..bd20adb --- /dev/null +++ b/backport-0002-CVE-2021-20251.patch @@ -0,0 +1,90 @@ +From 09c1945896df667788ac42a426484a18e4077dd6 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Wed, 13 Jul 2022 14:20:59 +1200 +Subject: [PATCH 04/37] CVE-2021-20251 lib:crypto: Add md4_hash_blob() for + hashing data with MD4 + +This lets us access MD4, which might not be available in hashlib, from +Python. This function is used in a following commit for hashing a +password to obtain the verifier for a SAMR password change. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 17b8d164f69a5ed79d9b7b7fc2f3f84f8ea534c8) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + lib/crypto/py_crypto.c | 35 +++++++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c +index 6753d3d8e9c..40b0cb9e9c0 100644 +--- a/lib/crypto/py_crypto.c ++++ b/lib/crypto/py_crypto.c +@@ -25,6 +25,7 @@ + #include + #include + #include "lib/crypto/gnutls_helpers.h" ++#include "lib/crypto/md4.h" + #include "libcli/auth/libcli_auth.h" + + static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) +@@ -160,6 +161,36 @@ static PyObject *py_crypto_des_crypt_blob_16(PyObject *self, PyObject *args) + sizeof(result)); + } + ++static PyObject *py_crypto_md4_hash_blob(PyObject *self, PyObject *args) ++{ ++ PyObject *py_data = NULL; ++ uint8_t *data = NULL; ++ Py_ssize_t data_size; ++ ++ uint8_t result[16]; ++ ++ bool ok; ++ int ret; ++ ++ ok = PyArg_ParseTuple(args, "S", ++ &py_data); ++ if (!ok) { ++ return NULL; ++ } ++ ++ ret = PyBytes_AsStringAndSize(py_data, ++ (char **)&data, ++ &data_size); ++ if (ret != 0) { ++ return NULL; ++ } ++ ++ mdfour(result, data, data_size); ++ ++ return PyBytes_FromStringAndSize((const char *)result, ++ sizeof(result)); ++} ++ + static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n" + "Encrypt the data with RC4 algorithm using the key"; + +@@ -167,11 +198,15 @@ static const char py_crypto_des_crypt_blob_16_doc[] = "des_crypt_blob_16(data, k + "Encrypt the 16-byte data with DES using " + "the 14-byte key"; + ++static const char py_crypto_md4_hash_blob_doc[] = "md4_hash_blob(data) -> bytes\n" ++ "Hash the data with MD4 algorithm"; ++ + static PyMethodDef py_crypto_methods[] = { + { "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc }, + { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" }, + { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" }, + { "des_crypt_blob_16", (PyCFunction)py_crypto_des_crypt_blob_16, METH_VARARGS, py_crypto_des_crypt_blob_16_doc }, ++ { "md4_hash_blob", (PyCFunction)py_crypto_md4_hash_blob, METH_VARARGS, py_crypto_md4_hash_blob_doc }, + {0}, + }; + +-- +2.35.0 diff --git a/backport-0003-CVE-2021-20251.patch b/backport-0003-CVE-2021-20251.patch new file mode 100644 index 0000000..afbd2c2 --- /dev/null +++ b/backport-0003-CVE-2021-20251.patch @@ -0,0 +1,99 @@ +From 3709de2f611839f7cc974919307e0eb9339b6d64 Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Tue, 30 Mar 2021 10:51:26 +1300 +Subject: [PATCH 07/37] CVE-2021-20251 s4-rpc_server: Use + authsam_search_account() to find the user + +This helps the bad password and audit log handling code as it +allows assumptions to be made about the attributes found in +the variable "msg", such as that DSDB_SEARCH_SHOW_EXTENDED_DN +was used. + +This ensures we can re-search on the DN via the embedded GUID, +which in in turn rename-proof. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit 439f96a2cfe77f6cbf331d965a387512c2db91c6) + +[jsutton@samba.org Adapted to LM hash still being present] + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/rpc_server/samr/samr_password.c | 38 +++++++++++-------------- + 1 file changed, 17 insertions(+), 21 deletions(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index c0fbaacd4d8..9e99822cd54 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -337,13 +337,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + struct ldb_context *sam_ctx = NULL; + struct ldb_dn *user_dn = NULL; + int ret; +- struct ldb_message **res; +- const char * const attrs[] = { "unicodePwd", "dBCSPwd", +- "userAccountControl", +- "msDS-ResultantPSO", +- "msDS-User-Account-Control-Computed", +- "badPwdCount", "badPasswordTime", +- "objectSid", NULL }; ++ struct ldb_message *msg = NULL; + struct samr_Password *nt_pwd, *lm_pwd; + struct samr_DomInfo1 *dominfo = NULL; + struct userPwdChangeFailureInformation *reject = NULL; +@@ -380,24 +374,26 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + +- /* we need the users dn and the domain dn (derived from the +- user SID). We also need the current lm and nt password hashes +- in order to decrypt the incoming passwords */ +- ret = gendb_search(sam_ctx, +- mem_ctx, NULL, &res, attrs, +- "(&(sAMAccountName=%s)(objectclass=user))", +- ldb_binary_encode_string(mem_ctx, r->in.account->string)); +- if (ret != 1) { +- status = NT_STATUS_NO_SUCH_USER; /* Converted to WRONG_PASSWORD below */ ++ /* ++ * We use authsam_search_account() to be consistent with the ++ * other callers in the bad password and audit log handling ++ * systems. It ensures we get DSDB_SEARCH_SHOW_EXTENDED_DN. ++ */ ++ status = authsam_search_account(mem_ctx, ++ sam_ctx, ++ r->in.account->string, ++ ldb_get_default_basedn(sam_ctx), ++ &msg); ++ if (!NT_STATUS_IS_OK(status)) { + goto failed; + } + +- user_dn = res[0]->dn; +- user_samAccountName = ldb_msg_find_attr_as_string(res[0], "samAccountName", NULL); +- user_objectSid = samdb_result_dom_sid(res, res[0], "objectSid"); ++ user_dn = msg->dn; ++ user_samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL); ++ user_objectSid = samdb_result_dom_sid(mem_ctx, msg, "objectSid"); + + status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx, +- res[0], &lm_pwd, &nt_pwd); ++ msg, &lm_pwd, &nt_pwd); + if (!NT_STATUS_IS_OK(status) ) { + goto failed; + } +@@ -538,7 +534,7 @@ failed: + + /* Only update the badPwdCount if we found the user */ + if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) { +- authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx)); ++ authsam_update_bad_pwd_count(sam_ctx, msg, ldb_get_default_basedn(sam_ctx)); + } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) { + /* Don't give the game away: (don't allow anonymous users to prove the existence of usernames) */ + status = NT_STATUS_WRONG_PASSWORD; +-- +2.35.0 diff --git a/backport-0004-CVE-2021-20251.patch b/backport-0004-CVE-2021-20251.patch new file mode 100644 index 0000000..c79b9b7 --- /dev/null +++ b/backport-0004-CVE-2021-20251.patch @@ -0,0 +1,105 @@ +From 52103fe067e9dc142005ac43fa69f7e9cd43df59 Mon Sep 17 00:00:00 2001 +From: Gary Lockyer +Date: Tue, 16 Mar 2021 10:52:58 +1300 +Subject: [PATCH 08/37] CVE-2021-20251 auth4: split + samdb_result_msds_LockoutObservationWindow() out + +samdb_result_msds_LockoutObservationWindow() is split out of +samdb_result_effective_badPwdCount() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Gary Lockyer +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 2087b0cd986b8959b2a402b9a1891472e47ca0b0) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/dsdb/common/util.c | 45 +++++++++++++++++++++++++++----------- + 1 file changed, 32 insertions(+), 13 deletions(-) + +diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c +index 551857a526c..e354731375e 100644 +--- a/source4/dsdb/common/util.c ++++ b/source4/dsdb/common/util.c +@@ -5388,9 +5388,9 @@ int dsdb_create_partial_replica_NC(struct ldb_context *ldb, struct ldb_dn *dn) + * This also requires that the domain_msg have (if present): + * - lockOutObservationWindow + */ +-static int dsdb_effective_badPwdCount(const struct ldb_message *user_msg, +- int64_t lockOutObservationWindow, +- NTTIME now) ++int dsdb_effective_badPwdCount(const struct ldb_message *user_msg, ++ int64_t lockOutObservationWindow, ++ NTTIME now) + { + int64_t badPasswordTime; + badPasswordTime = ldb_msg_find_attr_as_int64(user_msg, "badPasswordTime", 0); +@@ -5437,25 +5437,24 @@ static struct ldb_result *lookup_user_pso(struct ldb_context *sam_ldb, + } + + /* +- * Return the effective badPwdCount ++ * Return the msDS-LockoutObservationWindow for a user message + * + * This requires that the user_msg have (if present): +- * - badPasswordTime +- * - badPwdCount + * - msDS-ResultantPSO + */ +-int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb, +- TALLOC_CTX *mem_ctx, +- struct ldb_dn *domain_dn, +- const struct ldb_message *user_msg) ++int64_t samdb_result_msds_LockoutObservationWindow( ++ struct ldb_context *sam_ldb, ++ TALLOC_CTX *mem_ctx, ++ struct ldb_dn *domain_dn, ++ const struct ldb_message *user_msg) + { +- struct timeval tv_now = timeval_current(); +- NTTIME now = timeval_to_nttime(&tv_now); + int64_t lockOutObservationWindow; + struct ldb_result *res = NULL; + const char *attrs[] = { "msDS-LockoutObservationWindow", + NULL }; +- ++ if (domain_dn == NULL) { ++ smb_panic("domain dn is NULL"); ++ } + res = lookup_user_pso(sam_ldb, mem_ctx, user_msg, attrs); + + if (res != NULL) { +@@ -5471,7 +5470,27 @@ int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb, + samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, + "lockOutObservationWindow", NULL); + } ++ return lockOutObservationWindow; ++} + ++/* ++ * Return the effective badPwdCount ++ * ++ * This requires that the user_msg have (if present): ++ * - badPasswordTime ++ * - badPwdCount ++ * - msDS-ResultantPSO ++ */ ++int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb, ++ TALLOC_CTX *mem_ctx, ++ struct ldb_dn *domain_dn, ++ const struct ldb_message *user_msg) ++{ ++ struct timeval tv_now = timeval_current(); ++ NTTIME now = timeval_to_nttime(&tv_now); ++ int64_t lockOutObservationWindow = ++ samdb_result_msds_LockoutObservationWindow( ++ sam_ldb, mem_ctx, domain_dn, user_msg); + return dsdb_effective_badPwdCount(user_msg, lockOutObservationWindow, now); + } + +-- +2.35.0 diff --git a/backport-0005-CVE-2021-20251.patch b/backport-0005-CVE-2021-20251.patch new file mode 100644 index 0000000..c1de915 --- /dev/null +++ b/backport-0005-CVE-2021-20251.patch @@ -0,0 +1,264 @@ +From 74c5805eb9a498b99cce2cdafbdcf95fb7d8bbb4 Mon Sep 17 00:00:00 2001 +From: Gary Lockyer +Date: Wed, 27 Jan 2021 14:24:58 +1300 +Subject: [PATCH 09/37] CVE-2021-20251 s4 auth: Prepare to make bad password + count increment atomic + +To ensure that the bad password count is incremented atomically, +and that the successful logon accounting data is updated atomically, +without always opening a transaction, we will need to make a note +of all bad and successful passwords in a side-DB outside the +transaction lock. + +This provides the functions needed for that and hooks them in +(future commits will handle errors and use the results). + +Based on patches by Gary Lockyer + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit 408717242aad8adf4551f2394eee2d80a06c7e63) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/auth/sam.c | 187 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 187 insertions(+) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index 7c609655fcb..fb480947569 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -31,6 +31,8 @@ + #include "libcli/ldap/ldap_ndr.h" + #include "param/param.h" + #include "librpc/gen_ndr/ndr_winbind_c.h" ++#include "lib/dbwrap/dbwrap.h" ++#include "cluster/cluster.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_AUTH +@@ -825,6 +827,177 @@ static int authsam_get_user_pso(struct ldb_context *sam_ctx, + return LDB_SUCCESS; + } + ++static struct db_context *authsam_get_bad_password_db( ++ TALLOC_CTX *mem_ctx, ++ struct ldb_context *sam_ctx) ++{ ++ struct loadparm_context *lp_ctx = NULL; ++ const char *db_name = "bad_password"; ++ struct db_context *db_ctx = NULL; ++ ++ lp_ctx = ldb_get_opaque(sam_ctx, "loadparm"); ++ if (lp_ctx == NULL) { ++ DBG_ERR("Unable to get loadparm_context\n"); ++ return NULL; ++ } ++ ++ db_ctx = cluster_db_tmp_open(mem_ctx, lp_ctx, db_name, TDB_DEFAULT); ++ if (db_ctx == NULL) { ++ DBG_ERR("Unable to open bad password attempts database\n"); ++ return NULL; ++ } ++ return db_ctx; ++} ++ ++static NTSTATUS get_object_sid_as_tdb_data( ++ TALLOC_CTX *mem_ctx, ++ const struct ldb_message *msg, ++ struct dom_sid_buf *buf, ++ TDB_DATA *key) ++{ ++ struct dom_sid *objectsid = NULL; ++ ++ /* ++ * Convert the objectSID to a human readable form to ++ * make debugging easier ++ */ ++ objectsid = samdb_result_dom_sid(mem_ctx, msg, "objectSID"); ++ if (objectsid == NULL) { ++ DBG_ERR("Unable to extract objectSID\n"); ++ return NT_STATUS_INTERNAL_ERROR; ++ } ++ dom_sid_str_buf(objectsid, buf); ++ key->dptr = (unsigned char *)buf->buf; ++ key->dsize = strlen(buf->buf); ++ ++ talloc_free(objectsid); ++ ++ return NT_STATUS_OK; ++} ++ ++/* ++ * Add the users objectSID to the bad password attempt database ++ * to indicate that last authentication failed due to a bad password ++ */ ++static NTSTATUS authsam_set_bad_password_indicator( ++ struct ldb_context *sam_ctx, ++ TALLOC_CTX *mem_ctx, ++ const struct ldb_message *msg) ++{ ++ NTSTATUS status = NT_STATUS_OK; ++ struct dom_sid_buf buf; ++ TDB_DATA key = {0}; ++ TDB_DATA value = {0}; ++ struct db_context *db = NULL; ++ ++ TALLOC_CTX *ctx = talloc_new(mem_ctx); ++ if (ctx == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } ++ ++ db = authsam_get_bad_password_db(ctx, sam_ctx); ++ if (db == NULL) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto exit; ++ } ++ ++ status = get_object_sid_as_tdb_data(ctx, msg, &buf, &key); ++ if (!NT_STATUS_IS_OK(status)) { ++ goto exit; ++ } ++ ++ status = dbwrap_store(db, key, value, 0); ++ if (!NT_STATUS_IS_OK(status)) { ++ DBG_ERR("Unable to store bad password indicator\n"); ++ } ++exit: ++ talloc_free(ctx); ++ return status; ++} ++ ++/* ++ * see if the users objectSID is in the bad password attempt database ++ */ ++static NTSTATUS authsam_check_bad_password_indicator( ++ struct ldb_context *sam_ctx, ++ TALLOC_CTX *mem_ctx, ++ bool *exists, ++ const struct ldb_message *msg) ++{ ++ NTSTATUS status = NT_STATUS_OK; ++ struct dom_sid_buf buf; ++ TDB_DATA key = {0}; ++ struct db_context *db = NULL; ++ ++ TALLOC_CTX *ctx = talloc_new(mem_ctx); ++ if (ctx == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } ++ ++ db = authsam_get_bad_password_db(ctx, sam_ctx); ++ if (db == NULL) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto exit; ++ } ++ ++ status = get_object_sid_as_tdb_data(ctx, msg, &buf, &key); ++ if (!NT_STATUS_IS_OK(status)) { ++ goto exit; ++ } ++ ++ *exists = dbwrap_exists(db, key); ++exit: ++ talloc_free(ctx); ++ return status; ++} ++ ++/* ++ * Remove the users objectSID to the bad password attempt database ++ * to indicate that last authentication succeeded. ++ */ ++static NTSTATUS authsam_clear_bad_password_indicator( ++ struct ldb_context *sam_ctx, ++ TALLOC_CTX *mem_ctx, ++ const struct ldb_message *msg) ++{ ++ NTSTATUS status = NT_STATUS_OK; ++ struct dom_sid_buf buf; ++ TDB_DATA key = {0}; ++ struct db_context *db = NULL; ++ ++ TALLOC_CTX *ctx = talloc_new(mem_ctx); ++ if (ctx == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } ++ ++ db = authsam_get_bad_password_db(ctx, sam_ctx); ++ if (db == NULL) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto exit; ++ } ++ ++ status = get_object_sid_as_tdb_data(ctx, msg, &buf, &key); ++ if (!NT_STATUS_IS_OK(status)) { ++ goto exit; ++ } ++ ++ status = dbwrap_delete(db, key); ++ if (NT_STATUS_EQUAL(NT_STATUS_NOT_FOUND, status)) { ++ /* ++ * Ok there was no bad password indicator this is expected ++ */ ++ status = NT_STATUS_OK; ++ } ++ if (NT_STATUS_IS_ERR(status)) { ++ DBG_ERR("Unable to delete bad password indicator, %s %s\n", ++ nt_errstr(status), ++ get_friendly_nt_error_msg(status)); ++ } ++exit: ++ talloc_free(ctx); ++ return status; ++} ++ + NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + struct ldb_message *msg, + struct ldb_dn *domain_dn) +@@ -894,6 +1067,10 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + + ret = dsdb_autotransaction_request(sam_ctx, req); + talloc_free(req); ++ ++ status = authsam_set_bad_password_indicator( ++ sam_ctx, mem_ctx, msg); ++ /* Failure is ignored for now */ + } + + done: +@@ -1057,12 +1234,19 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + NTTIME now; + NTTIME lastLogonTimestamp; + bool am_rodc = false; ++ bool need_db_reread; + + mem_ctx = talloc_new(msg); + if (mem_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + ++ status = authsam_check_bad_password_indicator( ++ sam_ctx, mem_ctx, &need_db_reread, msg); ++ if (!NT_STATUS_IS_OK(status)) { ++ return status; ++ } ++ + lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0); + dbBadPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0); + if (interactive_or_kerberos) { +@@ -1197,6 +1381,9 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + talloc_free(req); + } + ++ status = authsam_clear_bad_password_indicator(sam_ctx, mem_ctx, msg); ++ /* Failure is ignored for now */ ++ + done: + if (ret != LDB_SUCCESS) { + DEBUG(0, ("Failed to set badPwdCount and lockoutTime " +-- +2.35.0 diff --git a/backport-0006-CVE-2021-20251.patch b/backport-0006-CVE-2021-20251.patch new file mode 100644 index 0000000..1d4401b --- /dev/null +++ b/backport-0006-CVE-2021-20251.patch @@ -0,0 +1,124 @@ +From 6e84ff6c09d243a09f214c1d6b9803533fb904f4 Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Tue, 30 Mar 2021 17:57:10 +1300 +Subject: [PATCH 10/37] CVE-2021-20251 auth4: Reread the user record if a bad + password is noticed. + +As is, this is pointless, as we need a transaction to make this +any less of a race, but this provides the steps towards that goal. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit 7b8e32efc336fb728e0c7e3dd6fbe2ed54122124) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/auth/sam.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 82 insertions(+) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index fb480947569..26ca35a601d 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -827,6 +827,68 @@ static int authsam_get_user_pso(struct ldb_context *sam_ctx, + return LDB_SUCCESS; + } + ++/* ++ * Re-read the bad password and successful logon data for a user. ++ * ++ * The DN in the passed user record should contain the "objectGUID" in case the ++ * object DN has changed. ++ */ ++NTSTATUS authsam_reread_user_logon_data( ++ struct ldb_context *sam_ctx, ++ TALLOC_CTX *mem_ctx, ++ const struct ldb_message *user_msg, ++ struct ldb_message **current) ++{ ++ const struct ldb_val *v = NULL; ++ struct ldb_result *res = NULL; ++ uint16_t acct_flags = 0; ++ const char *attr_name = "msDS-User-Account-Control-Computed"; ++ ++ int ret; ++ ++ /* ++ * Re-read the account details, using the GUID in case the DN ++ * is being changed (this is automatic in LDB because the ++ * original search also used DSDB_SEARCH_SHOW_EXTENDED_DN) ++ * ++ * We re read all the attributes in user_attrs, rather than using a ++ * subset to ensure that we can reuse existing validation code. ++ */ ++ ret = dsdb_search_dn(sam_ctx, ++ mem_ctx, ++ &res, ++ user_msg->dn, ++ user_attrs, ++ DSDB_SEARCH_SHOW_EXTENDED_DN); ++ if (ret != LDB_SUCCESS) { ++ DBG_ERR("Unable to re-read account control data for %s\n", ++ ldb_dn_get_linearized(user_msg->dn)); ++ return NT_STATUS_INTERNAL_ERROR; ++ } ++ ++ /* ++ * Ensure the account has not been locked out by another request ++ */ ++ v = ldb_msg_find_ldb_val(res->msgs[0], attr_name); ++ if (v == NULL || v->data == NULL) { ++ DBG_ERR("No %s attribute for %s\n", ++ attr_name, ++ ldb_dn_get_linearized(user_msg->dn)); ++ TALLOC_FREE(res); ++ return NT_STATUS_INTERNAL_ERROR; ++ } ++ acct_flags = samdb_result_acct_flags(res->msgs[0], attr_name); ++ if (acct_flags & ACB_AUTOLOCK) { ++ DBG_WARNING( ++ "Account for user %s was locked out.\n", ++ ldb_dn_get_linearized(user_msg->dn)); ++ TALLOC_FREE(res); ++ return NT_STATUS_ACCOUNT_LOCKED_OUT; ++ } ++ *current = res->msgs[0]; ++ return NT_STATUS_OK; ++} ++ + static struct db_context *authsam_get_bad_password_db( + TALLOC_CTX *mem_ctx, + struct ldb_context *sam_ctx) +@@ -1247,6 +1309,26 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + return status; + } + ++ if (need_db_reread) { ++ struct ldb_message *current = NULL; ++ ++ /* ++ * Re-read the account details, using the GUID ++ * embedded in DN so this is safe against a race where ++ * it is being renamed. ++ */ ++ status = authsam_reread_user_logon_data( ++ sam_ctx, mem_ctx, msg, ¤t); ++ if (!NT_STATUS_IS_OK(status)) { ++ /* ++ * The re-read can return account locked out, as well ++ * as an internal error ++ */ ++ return status; ++ } ++ msg = current; ++ } ++ + lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0); + dbBadPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0); + if (interactive_or_kerberos) { +-- +2.35.0 diff --git a/backport-0007-CVE-2021-20251.patch b/backport-0007-CVE-2021-20251.patch new file mode 100644 index 0000000..e9774ef --- /dev/null +++ b/backport-0007-CVE-2021-20251.patch @@ -0,0 +1,57 @@ +From 9712e371539e4e8d8f458eeaa24d8743e47f3d5e Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 5 Jul 2022 20:17:49 +1200 +Subject: [PATCH 12/37] CVE-2021-20251 auth4: Detect ACCOUNT_LOCKED_OUT error + for password change + +This is more specific than NT_STATUS_UNSUCCESSFUL, and for the SAMR +password change, matches the result the call to samdb_result_passwords() +would give. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 336e303cf1962b56b64c0d9d2b05ac15d00e8692) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/dsdb/common/util.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c +index e354731375e..679daa0348b 100644 +--- a/source4/dsdb/common/util.c ++++ b/source4/dsdb/common/util.c +@@ -2320,7 +2320,8 @@ int samdb_set_password_callback(struct ldb_request *req, struct ldb_reply *ares) + * change failed. + * + * Results: NT_STATUS_OK, NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL, +- * NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION ++ * NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION, ++ * NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCOUNT_LOCKED_OUT, NT_STATUS_NO_MEMORY + */ + static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, + struct ldb_dn *user_dn, struct ldb_dn *domain_dn, +@@ -2502,6 +2503,9 @@ static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX + if (W_ERROR_EQUAL(werr, WERR_PASSWORD_RESTRICTION)) { + status = NT_STATUS_PASSWORD_RESTRICTION; + } ++ if (W_ERROR_EQUAL(werr, WERR_ACCOUNT_LOCKED_OUT)) { ++ status = NT_STATUS_ACCOUNT_LOCKED_OUT; ++ } + } + } else if (ret == LDB_ERR_NO_SUCH_OBJECT) { + /* don't let the caller know if an account doesn't exist */ +@@ -2553,6 +2557,7 @@ NTSTATUS samdb_set_password(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, + * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION, + * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL, + * NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION, ++ * NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCOUNT_LOCKED_OUT, NT_STATUS_NO_MEMORY + * NT_STATUS_TRANSACTION_ABORTED, NT_STATUS_NO_SUCH_USER + */ + NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, +-- +2.35.0 diff --git a/backport-0008-CVE-2021-20251.patch b/backport-0008-CVE-2021-20251.patch new file mode 100644 index 0000000..714d031 --- /dev/null +++ b/backport-0008-CVE-2021-20251.patch @@ -0,0 +1,485 @@ +From 3d39ced39f8a24c0e94395b0a75d84a8025ff9f3 Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Tue, 30 Mar 2021 18:01:39 +1300 +Subject: [PATCH 13/37] CVE-2021-20251 s4 auth: make bad password count + increment atomic + +Ensure that the bad password count is incremented atomically, +and that the successful logon accounting data is updated atomically. + +Use bad password indicator (in a distinct TDB) to determine if to open a transaction + +We open a transaction when we have seen the hint that this user +has recorded a bad password. This allows us to avoid always +needing one, while not missing a possible lockout. + +We also go back and get a transation if we did not take out +one out but we chose to do a write (eg for lastLogonTimestamp) + +Based on patches by Gary Lockyer + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit de4cc0a3dae89f3e51a099282615cf80c8539e11) + +Conflict: remove selftest/knownfail.d/auth-sam selftest/knownfail_heimdal_kdc selftest/knownfail_mit_kdc +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + selftest/knownfail.d/auth-sam | 12 -- + selftest/knownfail_heimdal_kdc | 5 - + selftest/knownfail_mit_kdc | 3 - + source4/auth/sam.c | 296 +++++++++++++++++++++++++++------ + 4 files changed, 246 insertions(+), 70 deletions(-) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index 26ca35a601d..f740419c7e4 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -1073,7 +1073,9 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + NTSTATUS status; + struct ldb_result *domain_res; + struct ldb_message *msg_mod = NULL; ++ struct ldb_message *current = NULL; + struct ldb_message *pso_msg = NULL; ++ bool txn_active = false; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_new(msg); +@@ -1098,14 +1100,65 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + ret, ldb_dn_get_linearized(msg->dn)); + } + +- status = dsdb_update_bad_pwd_count(mem_ctx, sam_ctx, +- msg, domain_res->msgs[0], pso_msg, +- &msg_mod); ++ /* ++ * To ensure that the bad password count is updated atomically, ++ * we need to: ++ * begin a transaction ++ * re-read the account details, ++ * using the msgs[0], ++ pso_msg, ++ &msg_mod); ++ if (!NT_STATUS_IS_OK(status)) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } ++ ++ /* ++ * Write the data back to disk if required. ++ */ + if (msg_mod != NULL) { + struct ldb_request *req; + +@@ -1116,7 +1169,9 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + ldb_op_default_callback, + NULL); + if (ret != LDB_SUCCESS) { +- goto done; ++ TALLOC_FREE(msg_mod); ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; + } + + ret = ldb_request_add_control(req, +@@ -1124,31 +1179,72 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + false, NULL); + if (ret != LDB_SUCCESS) { + talloc_free(req); +- goto done; ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; + } + +- ret = dsdb_autotransaction_request(sam_ctx, req); ++ /* ++ * As we're in a transaction, make the ldb request directly ++ * to avoid the nested transaction that would result if we ++ * called dsdb_autotransaction_request ++ */ ++ ret = ldb_request(sam_ctx, req); ++ if (ret == LDB_SUCCESS) { ++ ret = ldb_wait(req->handle, LDB_WAIT_ALL); ++ } + talloc_free(req); +- ++ if (ret != LDB_SUCCESS) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } + status = authsam_set_bad_password_indicator( + sam_ctx, mem_ctx, msg); +- /* Failure is ignored for now */ ++ if (!NT_STATUS_IS_OK(status)) { ++ goto error; ++ } + } +- +-done: ++ /* ++ * Note that we may not have updated the user record, but ++ * committing the transaction in that case is still the correct ++ * thing to do. ++ * If the transaction was cancelled, this would be logged by ++ * the dsdb audit log as a failure. When in fact it is expected ++ * behaviour. ++ */ ++exit: ++ TALLOC_FREE(mem_ctx); ++ ret = ldb_transaction_commit(sam_ctx); + if (ret != LDB_SUCCESS) { +- DBG_ERR("Failed to update badPwdCount, badPasswordTime or " +- "set lockoutTime on %s: %s\n", +- ldb_dn_get_linearized(msg->dn), +- ldb_errstring(sam_ctx)); +- TALLOC_FREE(mem_ctx); ++ DBG_ERR("Error (%d) %s, committing transaction," ++ " while updating bad password count" ++ " for (%s)\n", ++ ret, ++ ldb_errstring(sam_ctx), ++ ldb_dn_get_linearized(msg->dn)); + return NT_STATUS_INTERNAL_ERROR; + } ++ return status; + ++error: ++ DBG_ERR("Failed to update badPwdCount, badPasswordTime or " ++ "set lockoutTime on %s: %s\n", ++ ldb_dn_get_linearized(msg->dn), ++ ldb_errstring(sam_ctx) != NULL ? ++ ldb_errstring(sam_ctx) :nt_errstr(status)); ++ if (txn_active) { ++ ret = ldb_transaction_cancel(sam_ctx); ++ if (ret != LDB_SUCCESS) { ++ DBG_ERR("Error rolling back transaction," ++ " while updating bad password count" ++ " on %s: %s\n", ++ ldb_dn_get_linearized(msg->dn), ++ ldb_errstring(sam_ctx)); ++ } ++ } + TALLOC_FREE(mem_ctx); +- return NT_STATUS_OK; +-} ++ return status; + ++} + + static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx, + struct ldb_message *msg_mod, +@@ -1296,6 +1392,7 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + NTTIME now; + NTTIME lastLogonTimestamp; + bool am_rodc = false; ++ bool txn_active = false; + bool need_db_reread; + + mem_ctx = talloc_new(msg); +@@ -1303,15 +1400,41 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + return NT_STATUS_NO_MEMORY; + } + ++ /* ++ * Any update of the last logon data, needs to be done inside a ++ * transaction. ++ * And the user data needs to be re-read, and the account re-checked ++ * for lockout. ++ * ++ * Howevver we have long-running transactions like replication ++ * that could otherwise grind the system to a halt so we first ++ * determine if *this* account has seen a bad password, ++ * otherwise we only start a transaction if there was a need ++ * (because a change was to be made). ++ */ ++ + status = authsam_check_bad_password_indicator( + sam_ctx, mem_ctx, &need_db_reread, msg); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + ++get_transaction: ++ + if (need_db_reread) { + struct ldb_message *current = NULL; + ++ /* ++ * Start a new transaction ++ */ ++ ret = ldb_transaction_start(sam_ctx); ++ if (ret != LDB_SUCCESS) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } ++ ++ txn_active = true; ++ + /* + * Re-read the account details, using the GUID + * embedded in DN so this is safe against a race where +@@ -1324,7 +1447,15 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + * The re-read can return account locked out, as well + * as an internal error + */ +- return status; ++ if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { ++ /* ++ * For NT_STATUS_ACCOUNT_LOCKED_OUT we want to commit ++ * the transaction. Again to avoid cluttering the ++ * audit logs with spurious errors ++ */ ++ goto exit; ++ } ++ goto error; + } + msg = current; + } +@@ -1345,9 +1476,15 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + + msg_mod = ldb_msg_new(mem_ctx); + if (msg_mod == NULL) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto error; + } ++ ++ /* ++ * By using the DN from msg->dn directly, we allow LDB to ++ * prefer the embedded GUID form, so this is actually quite ++ * safe even in the case where DN has been changed ++ */ + msg_mod->dn = msg->dn; + + if (lockoutTime != 0) { +@@ -1356,14 +1493,14 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + */ + ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "lockoutTime", 0); + if (ret != LDB_SUCCESS) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto error; + } + } else if (badPwdCount != 0) { + ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "badPwdCount", 0); + if (ret != LDB_SUCCESS) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto error; + } + } + +@@ -1375,8 +1512,8 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod, + "lastLogon", now); + if (ret != LDB_SUCCESS) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto error; + } + } + +@@ -1390,8 +1527,8 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, + "logonCount", logonCount); + if (ret != LDB_SUCCESS) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto error; + } + } else { + /* Set an unset logonCount to 0 on first successful login */ +@@ -1407,16 +1544,16 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + + ret = samdb_rodc(sam_ctx, &am_rodc); + if (ret != LDB_SUCCESS) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_INTERNAL_ERROR; ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; + } + + if (!am_rodc) { + status = authsam_update_lastlogon_timestamp(sam_ctx, msg_mod, domain_dn, + lastLogonTimestamp, now); + if (!NT_STATUS_IS_OK(status)) { +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto error; + } + } else { + /* Perform the (async) SendToSAM calls for MS-SAMS */ +@@ -1436,6 +1573,16 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + unsigned int i; + struct ldb_request *req; + ++ /* ++ * If it turns out we are going to update the DB, go ++ * back to the start, get a transaction and the ++ * current DB state and try again ++ */ ++ if (txn_active == false) { ++ need_db_reread = true; ++ goto get_transaction; ++ } ++ + /* mark all the message elements as LDB_FLAG_MOD_REPLACE */ + for (i=0;inum_elements;i++) { + msg_mod->elements[i].flags = LDB_FLAG_MOD_REPLACE; +@@ -1448,35 +1595,84 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + ldb_op_default_callback, + NULL); + if (ret != LDB_SUCCESS) { +- goto done; ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; + } + + ret = ldb_request_add_control(req, + DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE, + false, NULL); + if (ret != LDB_SUCCESS) { +- talloc_free(req); +- goto done; ++ TALLOC_FREE(req); ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; + } +- +- ret = dsdb_autotransaction_request(sam_ctx, req); +- talloc_free(req); ++ /* ++ * As we're in a transaction, make the ldb request directly ++ * to avoid the nested transaction that would result if we ++ * called dsdb_autotransaction_request ++ */ ++ ret = ldb_request(sam_ctx, req); ++ if (ret == LDB_SUCCESS) { ++ ret = ldb_wait(req->handle, LDB_WAIT_ALL); ++ } ++ TALLOC_FREE(req); ++ if (ret != LDB_SUCCESS) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } ++ } ++ status = authsam_clear_bad_password_indicator(sam_ctx, mem_ctx, msg); ++ if (!NT_STATUS_IS_OK(status)) { ++ goto error; + } + +- status = authsam_clear_bad_password_indicator(sam_ctx, mem_ctx, msg); +- /* Failure is ignored for now */ ++ /* ++ * Note that we may not have updated the user record, but ++ * committing the transaction in that case is still the correct ++ * thing to do. ++ * If the transaction was cancelled, this would be logged by ++ * the dsdb audit log as a failure. When in fact it is expected ++ * behaviour. ++ * ++ * Thankfully both TDB and LMDB seem to optimise for the empty ++ * transaction case ++ */ ++exit: ++ TALLOC_FREE(mem_ctx); + +-done: ++ if (txn_active == false) { ++ return status; ++ } ++ ++ ret = ldb_transaction_commit(sam_ctx); + if (ret != LDB_SUCCESS) { +- DEBUG(0, ("Failed to set badPwdCount and lockoutTime " +- "to 0 and/or lastlogon to now (%lld) " +- "%s: %s\n", (long long int)now, +- ldb_dn_get_linearized(msg_mod->dn), +- ldb_errstring(sam_ctx))); +- TALLOC_FREE(mem_ctx); ++ DBG_ERR("Error (%d) %s, committing transaction," ++ " while updating successful logon accounting" ++ " for (%s)\n", ++ ret, ++ ldb_errstring(sam_ctx), ++ ldb_dn_get_linearized(msg->dn)); + return NT_STATUS_INTERNAL_ERROR; + } ++ return status; + ++error: ++ DBG_ERR("Failed to update badPwdCount, badPasswordTime or " ++ "set lockoutTime on %s: %s\n", ++ ldb_dn_get_linearized(msg->dn), ++ ldb_errstring(sam_ctx) != NULL ? ++ ldb_errstring(sam_ctx) :nt_errstr(status)); ++ if (txn_active) { ++ ret = ldb_transaction_cancel(sam_ctx); ++ if (ret != LDB_SUCCESS) { ++ DBG_ERR("Error rolling back transaction," ++ " while updating bad password count" ++ " on %s: %s\n", ++ ldb_dn_get_linearized(msg->dn), ++ ldb_errstring(sam_ctx)); ++ } ++ } + TALLOC_FREE(mem_ctx); +- return NT_STATUS_OK; ++ return status; + } +-- +2.35.0 diff --git a/backport-0009-CVE-2021-20251.patch b/backport-0009-CVE-2021-20251.patch new file mode 100644 index 0000000..ca28ef2 --- /dev/null +++ b/backport-0009-CVE-2021-20251.patch @@ -0,0 +1,34 @@ +From 070efbca91b60670a421a8d2e710a6bd1dc5dbc7 Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Tue, 30 Mar 2021 16:35:44 +1300 +Subject: [PATCH 14/37] CVE-2021-20251 auth4: Add missing newline to debug + message on PSO read failure + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit 4a9e0fdccfa218fbb2c3eb87e1a955ade0364b98) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/auth/sam.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index f740419c7e4..2a63238d1b9 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -1096,7 +1096,7 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx, + * fallback to using the domain defaults so that we still + * record the bad password attempt + */ +- DBG_ERR("Error (%d) checking PSO for %s", ++ DBG_ERR("Error (%d) checking PSO for %s\n", + ret, ldb_dn_get_linearized(msg->dn)); + } + +-- +2.35.0 diff --git a/backport-0010-CVE-2021-20251.patch b/backport-0010-CVE-2021-20251.patch new file mode 100644 index 0000000..642e1ef --- /dev/null +++ b/backport-0010-CVE-2021-20251.patch @@ -0,0 +1,36 @@ +From fe989c2e39d3c97e44d771df01c2976a1a5619d9 Mon Sep 17 00:00:00 2001 +From: Gary Lockyer +Date: Thu, 25 Mar 2021 11:30:59 +1300 +Subject: [PATCH 15/37] CVE-2021-20251 auth4: Return only the result message + and free the surrounding result + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit b954acfde258a1909ed60c1c3e1015701582719f) + +Conflict: remove selftest/knownfail.d/auth-sam +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + selftest/knownfail.d/auth-sam | 1 - + source4/auth/sam.c | 3 ++- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index 2a63238d1b9..3190577818c 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -885,7 +885,8 @@ NTSTATUS authsam_reread_user_logon_data( + TALLOC_FREE(res); + return NT_STATUS_ACCOUNT_LOCKED_OUT; + } +- *current = res->msgs[0]; ++ *current = talloc_steal(mem_ctx, res->msgs[0]); ++ TALLOC_FREE(res); + return NT_STATUS_OK; + } + +-- +2.35.0 diff --git a/backport-0011-CVE-2021-20251.patch b/backport-0011-CVE-2021-20251.patch new file mode 100644 index 0000000..5e40a23 --- /dev/null +++ b/backport-0011-CVE-2021-20251.patch @@ -0,0 +1,198 @@ +From c2c65d16b96e016e3c1f01732e200bbf38dc1278 Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Thu, 25 Mar 2021 14:42:39 +1300 +Subject: [PATCH 16/37] CVE-2021-20251 auth4: Split + authsam_calculate_lastlogon_sync_interval() out + +authsam_calculate_lastlogon_sync_interval() is split out of authsam_update_lastlogon_timestamp() + +Based on work by Gary Lockyer + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit 55147335aec8194b6439169b040556a96db22e95) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/auth/sam.c | 115 ++++++++++++++++++++++++++++----------------- + 1 file changed, 73 insertions(+), 42 deletions(-) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index 3190577818c..52f23a08aa3 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -1247,40 +1247,36 @@ error: + + } + +-static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx, +- struct ldb_message *msg_mod, +- struct ldb_dn *domain_dn, +- NTTIME old_timestamp, +- NTTIME now) ++/* ++ * msDS-LogonTimeSyncInterval is an int32_t number of days. ++ * ++ * The docs say: "the initial update, after the domain functional ++ * level is raised to DS_BEHAVIOR_WIN2003 or higher, is calculated as ++ * 14 days minus a random percentage of 5 days", but we aren't doing ++ * that. The blogosphere seems to think that this randomised update ++ * happens everytime, but [MS-ADA1] doesn't agree. ++ * ++ * Dochelp referred us to the following blog post: ++ * http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx ++ * ++ * when msDS-LogonTimeSyncInterval is zero, the lastLogonTimestamp is ++ * not changed. ++ */ ++ ++static NTSTATUS authsam_calculate_lastlogon_sync_interval( ++ struct ldb_context *sam_ctx, ++ TALLOC_CTX *ctx, ++ struct ldb_dn *domain_dn, ++ NTTIME *sync_interval_nt) + { +- /* +- * We only set lastLogonTimestamp if the current value is older than +- * now - msDS-LogonTimeSyncInterval days. +- * +- * msDS-LogonTimeSyncInterval is an int32_t number of days, while +- * lastLogonTimestamp is in the 64 bit 100ns NTTIME format. +- * +- * The docs say: "the initial update, after the domain functional +- * level is raised to DS_BEHAVIOR_WIN2003 or higher, is calculated as +- * 14 days minus a random percentage of 5 days", but we aren't doing +- * that. The blogosphere seems to think that this randomised update +- * happens everytime, but [MS-ADA1] doesn't agree. +- * +- * Dochelp referred us to the following blog post: +- * http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx +- * +- * en msDS-LogonTimeSyncInterval is zero, the lastLogonTimestamp is +- * not changed. +- */ + static const char *attrs[] = { "msDS-LogonTimeSyncInterval", + NULL }; + int ret; + struct ldb_result *domain_res = NULL; + TALLOC_CTX *mem_ctx = NULL; +- int32_t sync_interval; +- NTTIME sync_interval_nt; ++ uint32_t sync_interval; + +- mem_ctx = talloc_new(msg_mod); ++ mem_ctx = talloc_new(ctx); + if (mem_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } +@@ -1296,15 +1292,7 @@ static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx, + "msDS-LogonTimeSyncInterval", + 14); + DEBUG(5, ("sync interval is %d\n", sync_interval)); +- if (sync_interval == 0){ +- /* +- * Setting msDS-LogonTimeSyncInterval to zero is how you ask +- * that nothing happens here. +- */ +- TALLOC_FREE(mem_ctx); +- return NT_STATUS_OK; +- } +- else if (sync_interval >= 5){ ++ if (sync_interval >= 5){ + /* + * Subtract "a random percentage of 5" days. Presumably this + * percentage is between 0 and 100, and modulus is accurate +@@ -1312,17 +1300,47 @@ static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx, + */ + uint32_t r = generate_random() % 6; + sync_interval -= r; +- DEBUG(5, ("randomised sync interval is %d (-%d)\n", sync_interval, r)); ++ DBG_INFO("randomised sync interval is %d (-%d)\n", sync_interval, r); + } + /* In the case where sync_interval < 5 there is no randomisation */ + +- sync_interval_nt = sync_interval * 24LL * 3600LL * 10000000LL; ++ /* ++ * msDS-LogonTimeSyncInterval is an int32_t number of days, ++ * while lastLogonTimestamp (to be updated) is in the 64 bit ++ * 100ns NTTIME format so we must convert. ++ */ ++ *sync_interval_nt = sync_interval * 24LL * 3600LL * 10000000LL; ++ TALLOC_FREE(mem_ctx); ++ return NT_STATUS_OK; ++} + ++ ++/* ++ * We only set lastLogonTimestamp if the current value is older than ++ * now - msDS-LogonTimeSyncInterval days. ++ * ++ * lastLogonTimestamp is in the 64 bit 100ns NTTIME format ++ */ ++static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx, ++ struct ldb_message *msg_mod, ++ struct ldb_dn *domain_dn, ++ NTTIME old_timestamp, ++ NTTIME now, ++ NTTIME sync_interval_nt) ++{ ++ int ret; + DEBUG(5, ("old timestamp is %lld, threshold %lld, diff %lld\n", + (long long int)old_timestamp, + (long long int)(now - sync_interval_nt), + (long long int)(old_timestamp - now + sync_interval_nt))); + ++ if (sync_interval_nt == 0){ ++ /* ++ * Setting msDS-LogonTimeSyncInterval to zero is how you ask ++ * that nothing happens here. ++ */ ++ return NT_STATUS_OK; ++ } + if (old_timestamp > now){ + DEBUG(0, ("lastLogonTimestamp is in the future! (%lld > %lld)\n", + (long long int)old_timestamp, (long long int)now)); +@@ -1337,11 +1355,9 @@ static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx, + "lastLogonTimestamp", now); + + if (ret != LDB_SUCCESS) { +- TALLOC_FREE(mem_ctx); + return NT_STATUS_NO_MEMORY; + } + } +- TALLOC_FREE(mem_ctx); + return NT_STATUS_OK; + } + +@@ -1550,8 +1566,23 @@ get_transaction: + } + + if (!am_rodc) { +- status = authsam_update_lastlogon_timestamp(sam_ctx, msg_mod, domain_dn, +- lastLogonTimestamp, now); ++ NTTIME sync_interval_nt; ++ ++ status = authsam_calculate_lastlogon_sync_interval( ++ sam_ctx, mem_ctx, domain_dn, &sync_interval_nt); ++ ++ if (!NT_STATUS_IS_OK(status)) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } ++ ++ status = authsam_update_lastlogon_timestamp( ++ sam_ctx, ++ msg_mod, ++ domain_dn, ++ lastLogonTimestamp, ++ now, ++ sync_interval_nt); + if (!NT_STATUS_IS_OK(status)) { + status = NT_STATUS_NO_MEMORY; + goto error; +-- +2.35.0 diff --git a/backport-0012-CVE-2021-20251.patch b/backport-0012-CVE-2021-20251.patch new file mode 100644 index 0000000..cbe7ee3 --- /dev/null +++ b/backport-0012-CVE-2021-20251.patch @@ -0,0 +1,60 @@ +From ac1970fa760f9cb3653f8d013e96976803a1e38d Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Thu, 25 Mar 2021 15:33:08 +1300 +Subject: [PATCH 17/37] CVE-2021-20251 auth4: Inline + samdb_result_effective_badPwdCount() in authsam_logon_success_accounting() + +By bringing this function inline it can then be split out in a +subsequent commit. + +Based on work by Gary Lockyer + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit 712181032a47318576ef35f6a6cf0f958aa538fb) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/auth/sam.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index 52f23a08aa3..6ef22182b8f 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -1479,11 +1479,17 @@ get_transaction: + + lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0); + dbBadPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0); ++ tv_now = timeval_current(); ++ now = timeval_to_nttime(&tv_now); ++ + if (interactive_or_kerberos) { + badPwdCount = dbBadPwdCount; + } else { +- badPwdCount = samdb_result_effective_badPwdCount(sam_ctx, mem_ctx, +- domain_dn, msg); ++ int64_t lockOutObservationWindow = ++ samdb_result_msds_LockoutObservationWindow( ++ sam_ctx, mem_ctx, domain_dn, msg); ++ badPwdCount = dsdb_effective_badPwdCount( ++ msg, lockOutObservationWindow, now); + } + lastLogonTimestamp = + ldb_msg_find_attr_as_int64(msg, "lastLogonTimestamp", 0); +@@ -1521,9 +1527,6 @@ get_transaction: + } + } + +- tv_now = timeval_current(); +- now = timeval_to_nttime(&tv_now); +- + if (interactive_or_kerberos || + (badPwdCount != 0 && lockoutTime == 0)) { + ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod, +-- +2.35.0 diff --git a/backport-0013-CVE-2021-20251.patch b/backport-0013-CVE-2021-20251.patch new file mode 100644 index 0000000..113214f --- /dev/null +++ b/backport-0013-CVE-2021-20251.patch @@ -0,0 +1,115 @@ +From d0ff61f5910bf87f830e5afb6a79b4c166557406 Mon Sep 17 00:00:00 2001 +From: Andrew Bartlett +Date: Tue, 30 Mar 2021 16:48:31 +1300 +Subject: [PATCH 18/37] CVE-2021-20251 auth4: Avoid reading the database twice + by precaculating some variables + +These variables are not important to protect against a race with +and a double-read can easily be avoided by moving them up the file +a little. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Andrew Bartlett +Reviewed-by: Joseph Sutton +Reviewed-by: Andreas Schneider +(cherry picked from commit b5f78b7b895a6b92cfdc9221b18d67ab18bc2a24) + +Conflict: remove selftest/knownfail.d/auth-sam +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + selftest/knownfail.d/auth-sam | 12 -------- + source4/auth/sam.c | 55 +++++++++++++++++++++++------------ + 2 files changed, 36 insertions(+), 31 deletions(-) + delete mode 100644 selftest/knownfail.d/auth-sam + +diff --git a/source4/auth/sam.c b/source4/auth/sam.c +index 6ef22182b8f..8b575a9bc51 100644 +--- a/source4/auth/sam.c ++++ b/source4/auth/sam.c +@@ -1408,6 +1408,8 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + struct timeval tv_now; + NTTIME now; + NTTIME lastLogonTimestamp; ++ int64_t lockOutObservationWindow; ++ NTTIME sync_interval_nt = 0; + bool am_rodc = false; + bool txn_active = false; + bool need_db_reread; +@@ -1436,6 +1438,36 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx, + return status; + } + ++ if (interactive_or_kerberos == false) { ++ /* ++ * Avoid calculating this twice, it reads the PSO. A ++ * race on this is unimportant. ++ */ ++ lockOutObservationWindow ++ = samdb_result_msds_LockoutObservationWindow( ++ sam_ctx, mem_ctx, domain_dn, msg); ++ } ++ ++ ret = samdb_rodc(sam_ctx, &am_rodc); ++ if (ret != LDB_SUCCESS) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } ++ ++ if (!am_rodc) { ++ /* ++ * Avoid reading the main domain DN twice. A race on ++ * this is unimportant. ++ */ ++ status = authsam_calculate_lastlogon_sync_interval( ++ sam_ctx, mem_ctx, domain_dn, &sync_interval_nt); ++ ++ if (!NT_STATUS_IS_OK(status)) { ++ status = NT_STATUS_INTERNAL_ERROR; ++ goto error; ++ } ++ } ++ + get_transaction: + + if (need_db_reread) { +@@ -1485,9 +1517,10 @@ get_transaction: + if (interactive_or_kerberos) { + badPwdCount = dbBadPwdCount; + } else { +- int64_t lockOutObservationWindow = +- samdb_result_msds_LockoutObservationWindow( +- sam_ctx, mem_ctx, domain_dn, msg); ++ /* ++ * We get lockOutObservationWindow above, before the ++ * transaction ++ */ + badPwdCount = dsdb_effective_badPwdCount( + msg, lockOutObservationWindow, now); + } +@@ -1562,23 +1595,7 @@ get_transaction: + } + } + +- ret = samdb_rodc(sam_ctx, &am_rodc); +- if (ret != LDB_SUCCESS) { +- status = NT_STATUS_INTERNAL_ERROR; +- goto error; +- } +- + if (!am_rodc) { +- NTTIME sync_interval_nt; +- +- status = authsam_calculate_lastlogon_sync_interval( +- sam_ctx, mem_ctx, domain_dn, &sync_interval_nt); +- +- if (!NT_STATUS_IS_OK(status)) { +- status = NT_STATUS_INTERNAL_ERROR; +- goto error; +- } +- + status = authsam_update_lastlogon_timestamp( + sam_ctx, + msg_mod, +-- +2.35.0 diff --git a/backport-0014-CVE-2021-20251.patch b/backport-0014-CVE-2021-20251.patch new file mode 100644 index 0000000..a1cdd58 --- /dev/null +++ b/backport-0014-CVE-2021-20251.patch @@ -0,0 +1,43 @@ +From d874615c8f4eef5a429ebdb518594ade37bbae0f Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Sat, 9 Jul 2022 15:53:51 +1200 +Subject: [PATCH 19/37] CVE-2021-20251 s4-auth: Pass through error code from + badPwdCount update + +The error code may be NT_STATUS_ACCOUNT_LOCKED_OUT, which we use in +preference to NT_STATUS_WRONG_PASSWORD. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit d8a862cb811489abb67d4cf3a7fbd83d05c7e5cb) + +Conflict: remove selftest/knownfail_heimdal_kdc selftest/knownfail_mit_kdc +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + selftest/knownfail_heimdal_kdc | 1 - + selftest/knownfail_mit_kdc | 1 - + source4/auth/ntlm/auth_sam.c | 6 +++++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c +index cf0656ae0da..9c4790c7c3f 100644 +--- a/source4/auth/ntlm/auth_sam.c ++++ b/source4/auth/ntlm/auth_sam.c +@@ -518,7 +518,11 @@ static NTSTATUS authsam_password_check_and_record(struct auth4_context *auth_con + } + + TALLOC_FREE(tmp_ctx); +- return NT_STATUS_WRONG_PASSWORD; ++ ++ if (NT_STATUS_IS_OK(nt_status)) { ++ nt_status = NT_STATUS_WRONG_PASSWORD; ++ } ++ return nt_status; + } + + static NTSTATUS authsam_authenticate(struct auth4_context *auth_context, +-- +2.35.0 diff --git a/backport-0015-CVE-2021-20251.patch b/backport-0015-CVE-2021-20251.patch new file mode 100644 index 0000000..50d4afa --- /dev/null +++ b/backport-0015-CVE-2021-20251.patch @@ -0,0 +1,91 @@ +From 8f6ad1482641e46d1d0771b398ca20c8642206b7 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Sat, 9 Jul 2022 15:44:21 +1200 +Subject: [PATCH 20/37] CVE-2021-20251 s4:dsdb: Update bad password count + inside transaction + +Previously, there was a gap between calling dsdb_update_bad_pwd_count() +and dsdb_module_modify() where no transaction was in effect. Another +process could slip in and modify badPwdCount, only for our update to +immediately overwrite it. Doing the update inside the transaction will +help for the following commit when we make it atomic. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit a65147a9e98ead70869cdfa20ffcc9c167dbf535) + +[jsutton@samba.org Fixed conflicts due to lack of dbg_ret variable] + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + .../dsdb/samdb/ldb_modules/password_hash.c | 37 ++++++++++--------- + 1 file changed, 19 insertions(+), 18 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 3978d82a79a..f44fa418e81 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -2695,24 +2695,6 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io + NTSTATUS status; + int ret; + +- /* PSO search result is optional (NULL if no PSO applies) */ +- if (io->ac->pso_res != NULL) { +- pso_msg = io->ac->pso_res->message; +- } +- +- status = dsdb_update_bad_pwd_count(io->ac, ldb, +- io->ac->search_res->message, +- io->ac->dom_res->message, +- pso_msg, +- &mod_msg); +- if (!NT_STATUS_IS_OK(status)) { +- goto done; +- } +- +- if (mod_msg == NULL) { +- goto done; +- } +- + /* + * OK, horrible semantics ahead. + * +@@ -2755,6 +2737,24 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io + goto done; + } + ++ /* PSO search result is optional (NULL if no PSO applies) */ ++ if (io->ac->pso_res != NULL) { ++ pso_msg = io->ac->pso_res->message; ++ } ++ ++ status = dsdb_update_bad_pwd_count(io->ac, ldb, ++ io->ac->search_res->message, ++ io->ac->dom_res->message, ++ pso_msg, ++ &mod_msg); ++ if (!NT_STATUS_IS_OK(status)) { ++ goto end_transaction; ++ } ++ ++ if (mod_msg == NULL) { ++ goto end_transaction; ++ } ++ + ret = dsdb_module_modify(io->ac->module, mod_msg, + DSDB_FLAG_NEXT_MODULE, + io->ac->req); +@@ -2768,6 +2768,7 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io + */ + } + ++end_transaction: + ret = ldb_next_end_trans(io->ac->module); + if (ret != LDB_SUCCESS) { + ldb_debug(ldb, LDB_DEBUG_ERROR, +-- +2.35.0 diff --git a/backport-0016-CVE-2021-20251.patch b/backport-0016-CVE-2021-20251.patch new file mode 100644 index 0000000..90b9836 --- /dev/null +++ b/backport-0016-CVE-2021-20251.patch @@ -0,0 +1,93 @@ +From 2451d80d18510f7fb9edea4106f1898efe15cc0b Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Sat, 9 Jul 2022 15:54:12 +1200 +Subject: [PATCH 21/37] CVE-2021-20251 s4:dsdb: Make badPwdCount update atomic + +We reread the account details inside the transaction in case the account +has been locked out in the meantime. If it has, we return the +appropriate error code. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 96479747bdb5bc5f33d903085f5f69793f369e3a) + +[jsutton@samba.org Fixed conflict due to lack of dbg_ret variable] + +Conflict: remove selftest/flapping.d/ldap-pwd-change-race +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + selftest/flapping.d/ldap-pwd-change-race | 5 ---- + .../dsdb/samdb/ldb_modules/password_hash.c | 27 ++++++++++++++++--- + 2 files changed, 24 insertions(+), 8 deletions(-) + delete mode 100644 selftest/flapping.d/ldap-pwd-change-race + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index f44fa418e81..fb4deeae9f5 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -45,6 +45,7 @@ + #include "lib/crypto/md4.h" + #include "param/param.h" + #include "lib/krb5_wrap/krb5_samba.h" ++#include "auth/auth_sam.h" + #include "auth/common_auth.h" + #include "lib/messaging/messaging.h" + #include "lib/param/loadparm.h" +@@ -2692,7 +2693,8 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io + struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); + struct ldb_message *mod_msg = NULL; + struct ldb_message *pso_msg = NULL; +- NTSTATUS status; ++ struct ldb_message *current = NULL; ++ NTSTATUS status = NT_STATUS_OK; + int ret; + + /* +@@ -2737,13 +2739,28 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io + goto done; + } + ++ /* ++ * Re-read the account details, using the GUID in case the DN ++ * is being changed. ++ */ ++ status = authsam_reread_user_logon_data( ++ ldb, io->ac, ++ io->ac->search_res->message, ++ ¤t); ++ if (!NT_STATUS_IS_OK(status)) { ++ /* The re-read can return account locked out, as well ++ * as an internal error ++ */ ++ goto end_transaction; ++ } ++ + /* PSO search result is optional (NULL if no PSO applies) */ + if (io->ac->pso_res != NULL) { + pso_msg = io->ac->pso_res->message; + } + + status = dsdb_update_bad_pwd_count(io->ac, ldb, +- io->ac->search_res->message, ++ current, + io->ac->dom_res->message, + pso_msg, + &mod_msg); +@@ -2793,7 +2810,11 @@ end_transaction: + + done: + ret = LDB_ERR_CONSTRAINT_VIOLATION; +- *werror = WERR_INVALID_PASSWORD; ++ if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { ++ *werror = WERR_ACCOUNT_LOCKED_OUT; ++ } else { ++ *werror = WERR_INVALID_PASSWORD; ++ } + ldb_asprintf_errstring(ldb, + "%08X: %s - check_password_restrictions: " + "The old password specified doesn't match!", +-- +2.35.0 diff --git a/backport-0017-CVE-2021-20251.patch b/backport-0017-CVE-2021-20251.patch new file mode 100644 index 0000000..07fadc1 --- /dev/null +++ b/backport-0017-CVE-2021-20251.patch @@ -0,0 +1,42 @@ +From c20bab7318317e02875066c5fc04eabb26143c1a Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Sat, 9 Jul 2022 15:55:02 +1200 +Subject: [PATCH 25/37] CVE-2021-20251 s4-rpc_server: Check badPwdCount update + return status + +If the account has been locked out in the meantime (indicated by +NT_STATUS_ACCOUNT_LOCKED_OUT), we should return the appropriate error +code. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit a268a1a0e304d0702469e4ac146d8af5e7384c39) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/rpc_server/samr/samr_password.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index 9e99822cd54..fa323c1a49a 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -534,7 +534,11 @@ failed: + + /* Only update the badPwdCount if we found the user */ + if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) { +- authsam_update_bad_pwd_count(sam_ctx, msg, ldb_get_default_basedn(sam_ctx)); ++ NTSTATUS bad_pwd_status = authsam_update_bad_pwd_count( ++ sam_ctx, msg, ldb_get_default_basedn(sam_ctx)); ++ if (NT_STATUS_EQUAL(bad_pwd_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { ++ status = bad_pwd_status; ++ } + } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) { + /* Don't give the game away: (don't allow anonymous users to prove the existence of usernames) */ + status = NT_STATUS_WRONG_PASSWORD; +-- +2.35.0 diff --git a/backport-0018-CVE-2021-20251.patch b/backport-0018-CVE-2021-20251.patch new file mode 100644 index 0000000..49d0a2e --- /dev/null +++ b/backport-0018-CVE-2021-20251.patch @@ -0,0 +1,43 @@ +From c2ed83fe0462af76b56aa4f0a992b8d36975bd32 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Mon, 4 Jul 2022 20:51:38 +1200 +Subject: [PATCH 26/37] CVE-2021-20251 s4:auth_winbind: Check return status of + authsam_logon_success_accounting() + +This may return an error if we find the account is locked out. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 268ea7bef5af4b9c8a02f4f5856113ff0664d9e8) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/auth/ntlm/auth_winbind.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c +index d7879966603..6381f866667 100644 +--- a/source4/auth/ntlm/auth_winbind.c ++++ b/source4/auth/ntlm/auth_winbind.c +@@ -252,11 +252,14 @@ static void winbind_check_password_done(struct tevent_req *subreq) + status = authsam_search_account(state, ctx->auth_ctx->sam_ctx, + nt4_account, domain_dn, &msg); + if (NT_STATUS_IS_OK(status)) { +- authsam_logon_success_accounting( ++ status = authsam_logon_success_accounting( + ctx->auth_ctx->sam_ctx, msg, + domain_dn, + user_info->flags & USER_INFO_INTERACTIVE_LOGON, + NULL); ++ if (tevent_req_nterror(req, status)) { ++ return; ++ } + } + } + +-- +2.35.0 diff --git a/backport-0019-CVE-2021-20251.patch b/backport-0019-CVE-2021-20251.patch new file mode 100644 index 0000000..6b456e8 --- /dev/null +++ b/backport-0019-CVE-2021-20251.patch @@ -0,0 +1,135 @@ +From e33836470d875f81278b4b8faf933a85c2f2daed Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Mon, 11 Jan 2021 12:11:35 -0800 +Subject: [PATCH 27/37] CVE-2021-20251 s3: ensure bad password count atomic + updates + +The bad password count is supposed to limit the number of failed login +attempt a user can make before being temporarily locked out, but race +conditions between processes have allowed determined attackers to make +many more than the specified number of attempts. This is especially +bad on constrained or overcommitted hardware. + +To fix this, once a bad password is detected, we reload the sam account +information under a user-specific mutex, ensuring we have an up to +date bad password count. + +Discovered by Nathaniel W. Turner. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Jeremy Allison +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 8587734bf989aeaafa9d09d78d0f381caf52d285) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source3/auth/check_samsec.c | 77 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 77 insertions(+) + +diff --git a/source3/auth/check_samsec.c b/source3/auth/check_samsec.c +index b9563c958a9..bd8ca8de2f0 100644 +--- a/source3/auth/check_samsec.c ++++ b/source3/auth/check_samsec.c +@@ -379,6 +379,8 @@ NTSTATUS check_sam_security(const DATA_BLOB *challenge, + const uint8_t *nt_pw; + const uint8_t *lm_pw; + uint32_t acct_ctrl; ++ char *mutex_name_by_user = NULL; ++ struct named_mutex *mtx = NULL; + + /* the returned struct gets kept on the server_info, by means + of a steal further down */ +@@ -418,6 +420,79 @@ NTSTATUS check_sam_security(const DATA_BLOB *challenge, + challenge, lm_pw, nt_pw, + user_info, &user_sess_key, &lm_sess_key); + ++ /* ++ * We must re-load the sam acount information under a mutex ++ * lock to ensure we don't miss any concurrent account lockout ++ * changes. ++ */ ++ ++ /* Clear out old sampass info. */ ++ TALLOC_FREE(sampass); ++ acct_ctrl = 0; ++ username = NULL; ++ nt_pw = NULL; ++ lm_pw = NULL; ++ ++ sampass = samu_new(mem_ctx); ++ if (sampass == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } ++ ++ mutex_name_by_user = talloc_asprintf(mem_ctx, ++ "check_sam_security_mutex_%s", ++ user_info->mapped.account_name); ++ if (mutex_name_by_user == NULL) { ++ nt_status = NT_STATUS_NO_MEMORY; ++ goto done; ++ } ++ ++ /* Grab the named mutex under root with 30 second timeout. */ ++ become_root(); ++ mtx = grab_named_mutex(mem_ctx, mutex_name_by_user, 30); ++ if (mtx != NULL) { ++ /* Re-load the account information if we got the mutex. */ ++ ret = pdb_getsampwnam(sampass, user_info->mapped.account_name); ++ } ++ unbecome_root(); ++ ++ /* Everything from here on until mtx is freed is done under the mutex.*/ ++ ++ if (mtx == NULL) { ++ DBG_ERR("Acquisition of mutex %s failed " ++ "for user %s\n", ++ mutex_name_by_user, ++ user_info->mapped.account_name); ++ nt_status = NT_STATUS_INTERNAL_ERROR; ++ goto done; ++ } ++ ++ if (!ret) { ++ /* ++ * Re-load of account failed. This could only happen if the ++ * user was deleted in the meantime. ++ */ ++ DBG_NOTICE("reload of user '%s' in passdb failed.\n", ++ user_info->mapped.account_name); ++ nt_status = NT_STATUS_NO_SUCH_USER; ++ goto done; ++ } ++ ++ /* Re-load the account control info. */ ++ acct_ctrl = pdb_get_acct_ctrl(sampass); ++ username = pdb_get_username(sampass); ++ ++ /* ++ * Check if the account is now locked out - now under the mutex. ++ * This can happen if the server is under ++ * a password guess attack and the ACB_AUTOLOCK is set by ++ * another process. ++ */ ++ if (acct_ctrl & ACB_AUTOLOCK) { ++ DBG_NOTICE("Account for user %s was locked out.\n", username); ++ nt_status = NT_STATUS_ACCOUNT_LOCKED_OUT; ++ goto done; ++ } ++ + /* Notify passdb backend of login success/failure. If not + NT_STATUS_OK the backend doesn't like the login */ + +@@ -510,6 +585,8 @@ done: + TALLOC_FREE(sampass); + data_blob_free(&user_sess_key); + data_blob_free(&lm_sess_key); ++ TALLOC_FREE(mutex_name_by_user); ++ TALLOC_FREE(mtx); + return nt_status; + } + +-- +2.35.0 diff --git a/backport-0020-CVE-2021-20251.patch b/backport-0020-CVE-2021-20251.patch new file mode 100644 index 0000000..ea787f8 --- /dev/null +++ b/backport-0020-CVE-2021-20251.patch @@ -0,0 +1,160 @@ +From 1e0b482753426713e740bf8fa19175163abffeec Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 5 Jul 2022 20:17:33 +1200 +Subject: [PATCH 28/37] CVE-2021-20251 s3: Ensure bad password count atomic + updates for SAMR password change + +The bad password count is supposed to limit the number of failed login +attempt a user can make before being temporarily locked out, but race +conditions between processes have allowed determined attackers to make +many more than the specified number of attempts. This is especially +bad on constrained or overcommitted hardware. + +To fix this, once a bad password is detected, we reload the sam account +information under a user-specific mutex, ensuring we have an up to +date bad password count. + +Derived from a similar patch to source3/auth/check_samsec.c by +Jeremy Allison + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 65c473d4a53fc8a22a0d531aff45203ea3a4d99b) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source3/rpc_server/samr/srv_samr_chgpasswd.c | 81 ++++++++++++++++++-- + 1 file changed, 75 insertions(+), 6 deletions(-) + +diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c +index e326745169e..798993bb542 100644 +--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c ++++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c +@@ -1201,6 +1201,8 @@ NTSTATUS pass_oem_change(char *user, const char *rhost, + bool ret = false; + bool updated_badpw = false; + NTSTATUS update_login_attempts_status; ++ char *mutex_name_by_user = NULL; ++ struct named_mutex *mtx = NULL; + + if (!(sampass = samu_new(NULL))) { + return NT_STATUS_NO_MEMORY; +@@ -1212,15 +1214,15 @@ NTSTATUS pass_oem_change(char *user, const char *rhost, + + if (ret == false) { + DEBUG(0,("pass_oem_change: getsmbpwnam returned NULL\n")); +- TALLOC_FREE(sampass); +- return NT_STATUS_NO_SUCH_USER; ++ nt_status = NT_STATUS_NO_SUCH_USER; ++ goto done; + } + + /* Quit if the account was locked out. */ + if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) { + DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", user)); +- TALLOC_FREE(sampass); +- return NT_STATUS_ACCOUNT_LOCKED_OUT; ++ nt_status = NT_STATUS_ACCOUNT_LOCKED_OUT; ++ goto done; + } + + nt_status = check_oem_password(user, +@@ -1231,6 +1233,71 @@ NTSTATUS pass_oem_change(char *user, const char *rhost, + sampass, + &new_passwd); + ++ /* ++ * We must re-load the sam acount information under a mutex ++ * lock to ensure we don't miss any concurrent account lockout ++ * changes. ++ */ ++ ++ /* Clear out old sampass info. */ ++ TALLOC_FREE(sampass); ++ ++ sampass = samu_new(NULL); ++ if (sampass == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } ++ ++ mutex_name_by_user = talloc_asprintf(NULL, ++ "check_sam_security_mutex_%s", ++ user); ++ if (mutex_name_by_user == NULL) { ++ nt_status = NT_STATUS_NO_MEMORY; ++ goto done; ++ } ++ ++ /* Grab the named mutex under root with 30 second timeout. */ ++ become_root(); ++ mtx = grab_named_mutex(NULL, mutex_name_by_user, 30); ++ if (mtx != NULL) { ++ /* Re-load the account information if we got the mutex. */ ++ ret = pdb_getsampwnam(sampass, user); ++ } ++ unbecome_root(); ++ ++ /* Everything from here on until mtx is freed is done under the mutex.*/ ++ ++ if (mtx == NULL) { ++ DBG_ERR("Acquisition of mutex %s failed " ++ "for user %s\n", ++ mutex_name_by_user, ++ user); ++ nt_status = NT_STATUS_INTERNAL_ERROR; ++ goto done; ++ } ++ ++ if (!ret) { ++ /* ++ * Re-load of account failed. This could only happen if the ++ * user was deleted in the meantime. ++ */ ++ DBG_NOTICE("reload of user '%s' in passdb failed.\n", ++ user); ++ nt_status = NT_STATUS_NO_SUCH_USER; ++ goto done; ++ } ++ ++ /* ++ * Check if the account is now locked out - now under the mutex. ++ * This can happen if the server is under ++ * a password guess attack and the ACB_AUTOLOCK is set by ++ * another process. ++ */ ++ if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) { ++ DBG_NOTICE("Account for user %s was locked out.\n", user); ++ nt_status = NT_STATUS_ACCOUNT_LOCKED_OUT; ++ goto done; ++ } ++ + /* + * Notify passdb backend of login success/failure. If not + * NT_STATUS_OK the backend doesn't like the login +@@ -1278,8 +1345,7 @@ NTSTATUS pass_oem_change(char *user, const char *rhost, + } + + if (!NT_STATUS_IS_OK(nt_status)) { +- TALLOC_FREE(sampass); +- return nt_status; ++ goto done; + } + + /* We've already checked the old password here.... */ +@@ -1290,7 +1356,10 @@ NTSTATUS pass_oem_change(char *user, const char *rhost, + + memset(new_passwd, 0, strlen(new_passwd)); + ++done: + TALLOC_FREE(sampass); ++ TALLOC_FREE(mutex_name_by_user); ++ TALLOC_FREE(mtx); + + return nt_status; + } +-- +2.35.0 diff --git a/backport-0021-CVE-2021-20251.patch b/backport-0021-CVE-2021-20251.patch new file mode 100644 index 0000000..b398bda --- /dev/null +++ b/backport-0021-CVE-2021-20251.patch @@ -0,0 +1,53 @@ +From 288763062c0f5379c51b07f60ac17666545da76c Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 2 Aug 2022 14:35:33 +1200 +Subject: [PATCH 29/37] lib:util: Check memset_s() error code in + talloc_keep_secret_destructor() + +Panic if memset_s() fails. + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 03a50d8f7d872b6ef701d1207061c88b73d171bb) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + lib/util/talloc_keep_secret.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/lib/util/talloc_keep_secret.c b/lib/util/talloc_keep_secret.c +index d6aa38265f6..c427406cbba 100644 +--- a/lib/util/talloc_keep_secret.c ++++ b/lib/util/talloc_keep_secret.c +@@ -20,13 +20,26 @@ + + static int talloc_keep_secret_destructor(void *ptr) + { ++ int ret; + size_t size = talloc_get_size(ptr); + + if (unlikely(size == 0)) { + return 0; + } + +- memset_s(ptr, size, 0, size); ++ ret = memset_s(ptr, size, 0, size); ++ if (unlikely(ret != 0)) { ++ char *msg = NULL; ++ int ret2; ++ ret2 = asprintf(&msg, ++ "talloc_keep_secret_destructor: memset_s() failed: %s", ++ strerror(ret)); ++ if (ret2 != -1) { ++ smb_panic(msg); ++ } else { ++ smb_panic("talloc_keep_secret_destructor: memset_s() failed"); ++ } ++ } + + return 0; + } +-- +2.35.0 diff --git a/backport-0022-CVE-2021-20251.patch b/backport-0022-CVE-2021-20251.patch new file mode 100644 index 0000000..725a25e --- /dev/null +++ b/backport-0022-CVE-2021-20251.patch @@ -0,0 +1,34 @@ +From ce41eeab3a662f2457e4223fe8c822968c02b5b2 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 2 Aug 2022 14:35:50 +1200 +Subject: [PATCH 30/37] libcli:auth: Keep passwords from + convert_string_talloc() secret + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 6edf88f5c40421b9881666a2e78038ea9c547c24) + +[jsutton@samba.org Removed change to decode_pwd_string_from_buffer514() + that is not present in 4.16] + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + libcli/auth/smbencrypt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c +index fe20fe4e2a3..c4339272fb6 100644 +--- a/libcli/auth/smbencrypt.c ++++ b/libcli/auth/smbencrypt.c +@@ -937,6 +937,7 @@ bool decode_pw_buffer(TALLOC_CTX *ctx, + DEBUG(0, ("decode_pw_buffer: failed to convert incoming password\n")); + return false; + } ++ talloc_keep_secret(*pp_new_pwrd); + + #ifdef DEBUG_PASSWORD + DEBUG(100,("decode_pw_buffer: new_pwrd: ")); +-- +2.35.0 diff --git a/backport-0023-CVE-2021-20251.patch b/backport-0023-CVE-2021-20251.patch new file mode 100644 index 0000000..9aaf0e0 --- /dev/null +++ b/backport-0023-CVE-2021-20251.patch @@ -0,0 +1,45 @@ +From a8d7b00d9d11d85472e34a552d8cf4a4a6f176a5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= +Date: Mon, 8 Aug 2022 17:47:28 +0200 +Subject: [PATCH 31/37] lib:replace: Add macro BURN_STR() to zero memory of a + string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Pavel Filipenský +Reviewed-by: Andreas Schneider +(cherry picked from commit 8564380346ace981b957bb8464f2ecf007032062) + +[jsutton@samba.org Fixed conflict] + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + lib/replace/replace.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/lib/replace/replace.h b/lib/replace/replace.h +index 8609d84322c..3c938f26240 100644 +--- a/lib/replace/replace.h ++++ b/lib/replace/replace.h +@@ -846,6 +846,17 @@ typedef unsigned long long ptrdiff_t ; + */ + #define ZERO_ARRAY_LEN(x, l) memset_s((char *)(x), (l), 0, (l)) + ++/** ++ * Explicitly zero data in string. This is guaranteed to be not optimized ++ * away. ++ */ ++#define BURN_STR(x) do { \ ++ if ((x) != NULL) { \ ++ size_t s = strlen(x); \ ++ memset_s((x), s, 0, s); \ ++ } \ ++ } while(0) ++ + /** + * Work out how many elements there are in a static array. + */ +-- +2.35.0 diff --git a/backport-0024-CVE-2021-20251.patch b/backport-0024-CVE-2021-20251.patch new file mode 100644 index 0000000..44f1bc6 --- /dev/null +++ b/backport-0024-CVE-2021-20251.patch @@ -0,0 +1,58 @@ +From 34159e5b0c990a602ccd631318567de63d98f71e Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 6 Sep 2022 14:54:08 +1200 +Subject: [PATCH 32/37] s3:rpc_server: Use BURN_STR() to zero password + +This ensures these calls are not optimised away. + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 1258746ba85b8702628f95a19aba9afea96eab8b) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source3/rpc_server/samr/srv_samr_chgpasswd.c | 2 +- + source3/rpc_server/samr/srv_samr_nt.c | 6 ++---- + 2 files changed, 3 insertions(+), 5 deletions(-) + +diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c +index 798993bb542..a4029f6e50a 100644 +--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c ++++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c +@@ -1354,7 +1354,7 @@ NTSTATUS pass_oem_change(char *user, const char *rhost, + True, reject_reason); + unbecome_root(); + +- memset(new_passwd, 0, strlen(new_passwd)); ++ BURN_STR(new_passwd); + + done: + TALLOC_FREE(sampass); +diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c +index 7f2c0a861f5..a84125d93c2 100644 +--- a/source3/rpc_server/samr/srv_samr_nt.c ++++ b/source3/rpc_server/samr/srv_samr_nt.c +@@ -4945,9 +4945,7 @@ static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx, + } + } + +- if (plaintext_buf) { +- memset(plaintext_buf, '\0', strlen(plaintext_buf)); +- } ++ BURN_STR(plaintext_buf); + + if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) && + (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx, +@@ -5017,7 +5015,7 @@ static bool set_user_info_pw(uint8_t *pass, const char *rhost, struct samu *pwd) + } + } + +- memset(plaintext_buf, '\0', strlen(plaintext_buf)); ++ BURN_STR(plaintext_buf); + + DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n")); + +-- +2.35.0 diff --git a/backport-0025-CVE-2021-20251.patch b/backport-0025-CVE-2021-20251.patch new file mode 100644 index 0000000..ffb2162 --- /dev/null +++ b/backport-0025-CVE-2021-20251.patch @@ -0,0 +1,176 @@ +From 7d260b94df9af439b6d46fe58aebeee628b30897 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 2 Aug 2022 14:39:43 +1200 +Subject: [PATCH 33/37] CVE-2021-20251 s4-rpc_server: Extend scope of + transaction for ChangePasswordUser3 + +Now the initial account search is performed under the transaction, +ensuring the overall password change is atomic. We set DSDB_SESSION_INFO +to drop our privileges to those of the user before we perform the actual +password change, and restore them afterwards if we need to update the +bad password count. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit fcabcb326d385c1e1daaa8dae9820e33a3868f56) + +[jsutton@samba.org Included dsdb/common/util.h header for + DSDB_SESSION_INFO define] + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/rpc_server/samr/samr_password.c | 43 +++++++++++++++++++------ + 1 file changed, 34 insertions(+), 9 deletions(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index fa323c1a49a..cc0cf869b8d 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -26,6 +26,7 @@ + #include "rpc_server/samr/dcesrv_samr.h" + #include "system/time.h" + #include "lib/crypto/md4.h" ++#include "dsdb/common/util.h" + #include "dsdb/samdb/samdb.h" + #include "auth/auth.h" + #include "libcli/auth/libcli_auth.h" +@@ -350,6 +351,8 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + = lpcfg_ntlm_auth(dce_call->conn->dce_ctx->lp_ctx); + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t nt_session_key; ++ struct auth_session_info *call_session_info = NULL; ++ struct auth_session_info *old_session_info = NULL; + int rc; + + *r->out.dominfo = NULL; +@@ -374,6 +377,12 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + ++ ret = ldb_transaction_start(sam_ctx); ++ if (ret != LDB_SUCCESS) { ++ DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx))); ++ return NT_STATUS_TRANSACTION_ABORTED; ++ } ++ + /* + * We use authsam_search_account() to be consistent with the + * other callers in the bad password and audit log handling +@@ -385,6 +394,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + ldb_get_default_basedn(sam_ctx), + &msg); + if (!NT_STATUS_IS_OK(status)) { ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + +@@ -395,11 +405,13 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx, + msg, &lm_pwd, &nt_pwd); + if (!NT_STATUS_IS_OK(status) ) { ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + + if (!nt_pwd) { + status = NT_STATUS_WRONG_PASSWORD; ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + +@@ -415,6 +427,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + +@@ -424,17 +437,20 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + + if (!extract_pw_from_buffer(mem_ctx, r->in.nt_password->data, &new_password)) { + DEBUG(3,("samr: failed to decode password buffer\n")); + status = NT_STATUS_WRONG_PASSWORD; ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + + if (r->in.nt_verifier == NULL) { + status = NT_STATUS_WRONG_PASSWORD; ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + +@@ -444,10 +460,12 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + E_old_pw_hash(new_nt_hash, nt_pwd->hash, nt_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + if (memcmp(nt_verifier.hash, r->in.nt_verifier->hash, 16) != 0) { + status = NT_STATUS_WRONG_PASSWORD; ++ ldb_transaction_cancel(sam_ctx); + goto failed; + } + +@@ -476,16 +494,16 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + } + } + +- /* Connect to a SAMDB with user privileges for the password change */ +- sam_ctx = dcesrv_samdb_connect_as_user(mem_ctx, dce_call); +- if (sam_ctx == NULL) { +- return NT_STATUS_INVALID_SYSTEM_SERVICE; +- } ++ /* Drop to user privileges for the password change */ + +- ret = ldb_transaction_start(sam_ctx); ++ old_session_info = ldb_get_opaque(sam_ctx, DSDB_SESSION_INFO); ++ call_session_info = dcesrv_call_session_info(dce_call); ++ ++ ret = ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, call_session_info); + if (ret != LDB_SUCCESS) { +- DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx))); +- return NT_STATUS_TRANSACTION_ABORTED; ++ status = NT_STATUS_INVALID_SYSTEM_SERVICE; ++ ldb_transaction_cancel(sam_ctx); ++ goto failed; + } + + /* Performs the password modification. We pass the old hashes read out +@@ -499,6 +517,11 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + &reason, + &dominfo); + ++ /* Restore our privileges to system level */ ++ if (old_session_info != NULL) { ++ ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, old_session_info); ++ } ++ + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + goto failed; +@@ -534,7 +557,9 @@ failed: + + /* Only update the badPwdCount if we found the user */ + if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) { +- NTSTATUS bad_pwd_status = authsam_update_bad_pwd_count( ++ NTSTATUS bad_pwd_status; ++ ++ bad_pwd_status = authsam_update_bad_pwd_count( + sam_ctx, msg, ldb_get_default_basedn(sam_ctx)); + if (NT_STATUS_EQUAL(bad_pwd_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { + status = bad_pwd_status; +-- +2.35.0 diff --git a/backport-0026-CVE-2021-20251.patch b/backport-0026-CVE-2021-20251.patch new file mode 100644 index 0000000..89f4f29 --- /dev/null +++ b/backport-0026-CVE-2021-20251.patch @@ -0,0 +1,264 @@ +From 423d98094355031f60def9de9fedc0f8a8fc3d00 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 Jul 2022 10:57:19 +0200 +Subject: [PATCH 34/37] s3:rpc_server: Use a done goto label for + dcesrv_samr_SetUserInfo() + +This will be used in the following commits. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit a246ae993fd8553bf66aa8ee1700eb68b85f2857) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/rpc_server/samr/dcesrv_samr.c | 84 +++++++++++++++++---------- + 1 file changed, 54 insertions(+), 30 deletions(-) + +diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c +index 10c53b19e0d..ccb4e37bf31 100644 +--- a/source4/rpc_server/samr/dcesrv_samr.c ++++ b/source4/rpc_server/samr/dcesrv_samr.c +@@ -3713,13 +3713,14 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + r->in.info->info18.lm_pwd_active ? r->in.info->info18.lm_pwd.hash : NULL, + r->in.info->info18.nt_pwd_active ? r->in.info->info18.nt_pwd.hash : NULL); + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + + if (r->in.info->info18.password_expired > 0) { + struct ldb_message_element *set_el; + if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) { +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; +@@ -3731,8 +3732,10 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + break; + + case 21: +- if (r->in.info->info21.fields_present == 0) +- return NT_STATUS_INVALID_PARAMETER; ++ if (r->in.info->info21.fields_present == 0) { ++ status = NT_STATUS_INVALID_PARAMETER; ++ goto done; ++ } + + #define IFSET(bit) if (bit & r->in.info->info21.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) +@@ -3777,8 +3780,10 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + SET_UINT (msg, info21.code_page, "codePage"); + + /* password change fields */ +- IFSET(SAMR_FIELD_LAST_PWD_CHANGE) +- return NT_STATUS_ACCESS_DENIED; ++ IFSET(SAMR_FIELD_LAST_PWD_CHANGE) { ++ status = NT_STATUS_ACCESS_DENIED; ++ goto done; ++ } + + IFSET((SAMR_FIELD_LM_PASSWORD_PRESENT + | SAMR_FIELD_NT_PASSWORD_PRESENT)) { +@@ -3787,7 +3792,8 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + if (r->in.info->info21.lm_password_set) { + if ((r->in.info->info21.lm_owf_password.length != 16) + || (r->in.info->info21.lm_owf_password.size != 16)) { +- return NT_STATUS_INVALID_PARAMETER; ++ status = NT_STATUS_INVALID_PARAMETER; ++ goto done; + } + + lm_pwd_hash = (uint8_t *) r->in.info->info21.lm_owf_password.array; +@@ -3795,7 +3801,8 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + if (r->in.info->info21.nt_password_set) { + if ((r->in.info->info21.nt_owf_password.length != 16) + || (r->in.info->info21.nt_owf_password.size != 16)) { +- return NT_STATUS_INVALID_PARAMETER; ++ status = NT_STATUS_INVALID_PARAMETER; ++ goto done; + } + + nt_pwd_hash = (uint8_t *) r->in.info->info21.nt_owf_password.array; +@@ -3808,7 +3815,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + lm_pwd_hash, + nt_pwd_hash); + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + } + +@@ -3821,7 +3828,8 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; +@@ -3830,8 +3838,10 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + break; + + case 23: +- if (r->in.info->info23.info.fields_present == 0) +- return NT_STATUS_INVALID_PARAMETER; ++ if (r->in.info->info23.info.fields_present == 0) { ++ status = NT_STATUS_INVALID_PARAMETER; ++ goto done; ++ } + + #define IFSET(bit) if (bit & r->in.info->info23.info.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) +@@ -3877,8 +3887,10 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + SET_UINT (msg, info23.info.code_page, "codePage"); + + /* password change fields */ +- IFSET(SAMR_FIELD_LAST_PWD_CHANGE) +- return NT_STATUS_ACCESS_DENIED; ++ IFSET(SAMR_FIELD_LAST_PWD_CHANGE) { ++ status = NT_STATUS_ACCESS_DENIED; ++ goto done; ++ } + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) { + status = samr_set_password(dce_call, +@@ -3896,7 +3908,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + &r->in.info->info23.password); + } + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + + IFSET(SAMR_FIELD_EXPIRED_FLAG) { +@@ -3907,7 +3919,8 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; +@@ -3924,13 +3937,14 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + mem_ctx, + &r->in.info->info24.password); + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + + if (r->in.info->info24.password_expired > 0) { + struct ldb_message_element *set_el; + if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) { +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; +@@ -3938,8 +3952,10 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + break; + + case 25: +- if (r->in.info->info25.info.fields_present == 0) +- return NT_STATUS_INVALID_PARAMETER; ++ if (r->in.info->info25.info.fields_present == 0) { ++ status = NT_STATUS_INVALID_PARAMETER; ++ goto done; ++ } + + #define IFSET(bit) if (bit & r->in.info->info25.info.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) +@@ -3984,8 +4000,10 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + SET_UINT (msg, info25.info.code_page, "codePage"); + + /* password change fields */ +- IFSET(SAMR_FIELD_LAST_PWD_CHANGE) +- return NT_STATUS_ACCESS_DENIED; ++ IFSET(SAMR_FIELD_LAST_PWD_CHANGE) { ++ status = NT_STATUS_ACCESS_DENIED; ++ goto done; ++ } + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) { + status = samr_set_password_ex(dce_call, +@@ -4003,7 +4021,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + &r->in.info->info25.password); + } + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + + IFSET(SAMR_FIELD_EXPIRED_FLAG) { +@@ -4014,7 +4032,8 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; +@@ -4031,7 +4050,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + mem_ctx, + &r->in.info->info26.password); + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + + if (r->in.info->info26.password_expired > 0) { +@@ -4042,7 +4061,8 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { +- return NT_STATUS_NO_MEMORY; ++ status = NT_STATUS_NO_MEMORY; ++ goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; +@@ -4051,11 +4071,12 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + + default: + /* many info classes are not valid for SetUserInfo */ +- return NT_STATUS_INVALID_INFO_CLASS; ++ status = NT_STATUS_INVALID_INFO_CLASS; ++ goto done; + } + + if (!NT_STATUS_IS_OK(status)) { +- return status; ++ goto done; + } + + /* modify the samdb record */ +@@ -4066,11 +4087,14 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + ldb_dn_get_linearized(a_state->account_dn), + ldb_errstring(a_state->sam_ctx))); + +- return dsdb_ldb_err_to_ntstatus(ret); ++ status = dsdb_ldb_err_to_ntstatus(ret); ++ goto done; + } + } + +- return NT_STATUS_OK; ++ status = NT_STATUS_OK; ++done: ++ return status; + } + + +-- +2.35.0 diff --git a/backport-0027-CVE-2021-20251.patch b/backport-0027-CVE-2021-20251.patch new file mode 100644 index 0000000..157833c --- /dev/null +++ b/backport-0027-CVE-2021-20251.patch @@ -0,0 +1,106 @@ +From 3b90e9ca2233087f5582ed3678b07347acc14682 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 Jul 2022 10:59:13 +0200 +Subject: [PATCH 35/37] s4:rpc_server: Use sam_ctx consistently in + dcesrv_samr_SetUserInfo() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 1b3d7f811680f9ac66ca5822950b3eee081a06b0) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/rpc_server/samr/dcesrv_samr.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c +index ccb4e37bf31..15ca7cf039a 100644 +--- a/source4/rpc_server/samr/dcesrv_samr.c ++++ b/source4/rpc_server/samr/dcesrv_samr.c +@@ -3706,7 +3706,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + + case 18: + status = samr_set_password_buffers(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, +@@ -3808,7 +3808,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + nt_pwd_hash = (uint8_t *) r->in.info->info21.nt_owf_password.array; + } + status = samr_set_password_buffers(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, +@@ -3894,14 +3894,14 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) { + status = samr_set_password(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info23.password); + } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) { + status = samr_set_password(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, +@@ -3931,7 +3931,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + /* the set password levels are handled separately */ + case 24: + status = samr_set_password(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, +@@ -4007,14 +4007,14 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) { + status = samr_set_password_ex(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info25.password); + } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) { + status = samr_set_password_ex(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, +@@ -4044,7 +4044,7 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + /* the set password levels are handled separately */ + case 26: + status = samr_set_password_ex(dce_call, +- a_state->sam_ctx, ++ sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, +@@ -4081,11 +4081,11 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + + /* modify the samdb record */ + if (msg->num_elements > 0) { +- ret = ldb_modify(a_state->sam_ctx, msg); ++ ret = ldb_modify(sam_ctx, msg); + if (ret != LDB_SUCCESS) { + DEBUG(1,("Failed to modify record %s: %s\n", + ldb_dn_get_linearized(a_state->account_dn), +- ldb_errstring(a_state->sam_ctx))); ++ ldb_errstring(sam_ctx))); + + status = dsdb_ldb_err_to_ntstatus(ret); + goto done; +-- +2.35.0 diff --git a/backport-0028-CVE-2021-20251.patch b/backport-0028-CVE-2021-20251.patch new file mode 100644 index 0000000..c047272 --- /dev/null +++ b/backport-0028-CVE-2021-20251.patch @@ -0,0 +1,58 @@ +From f0c0f57a6168ff6d5ff4198343ddbbb18cb97631 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 Jul 2022 11:04:29 +0200 +Subject: [PATCH 36/37] s4:rpc_server: Add transaction for + dcesrv_samr_SetUserInfo() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 1aa403517ffc0d43df72ddc9fa2ce86ab5c33873) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/rpc_server/samr/dcesrv_samr.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c +index 15ca7cf039a..74edb32d773 100644 +--- a/source4/rpc_server/samr/dcesrv_samr.c ++++ b/source4/rpc_server/samr/dcesrv_samr.c +@@ -3647,6 +3647,13 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + return NT_STATUS_NO_MEMORY; + } + ++ ret = ldb_transaction_start(sam_ctx); ++ if (ret != LDB_SUCCESS) { ++ DBG_ERR("Failed to start a transaction: %s\n", ++ ldb_errstring(sam_ctx)); ++ return NT_STATUS_LOCK_NOT_GRANTED; ++ } ++ + switch (r->in.level) { + case 2: + SET_STRING(msg, info2.comment, "comment"); +@@ -4092,8 +4099,21 @@ static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALL + } + } + ++ ret = ldb_transaction_commit(sam_ctx); ++ if (ret != LDB_SUCCESS) { ++ DBG_ERR("Failed to commit transaction modifying account record " ++ "%s: %s\n", ++ ldb_dn_get_linearized(msg->dn), ++ ldb_errstring(sam_ctx)); ++ return NT_STATUS_INTERNAL_DB_CORRUPTION; ++ } ++ + status = NT_STATUS_OK; + done: ++ if (!NT_STATUS_IS_OK(status)) { ++ ldb_transaction_cancel(sam_ctx); ++ } ++ + return status; + } + +-- +2.35.0 diff --git a/backport-0029-CVE-2021-20251.patch b/backport-0029-CVE-2021-20251.patch new file mode 100644 index 0000000..8d81731 --- /dev/null +++ b/backport-0029-CVE-2021-20251.patch @@ -0,0 +1,41 @@ +From 014e4521be98b9e3ffed1fc7dff87e40c8f08096 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Tue, 2 Aug 2022 14:40:01 +1200 +Subject: [PATCH 37/37] CVE-2021-20251 dsdb/common: Remove transaction logic + from samdb_set_password() + +All of its callers, where necessary, take out a transaction covering the +entire password set or change operation, so a transaction is no longer +needed here. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 + +Signed-off-by: Joseph Sutton +Reviewed-by: Andreas Schneider +Reviewed-by: Andrew Bartlett +(cherry picked from commit 7981cba87e3a7256b12bfc5fdd89b136c12979ff) + +Conflict: NA +Reference: https://attachments.samba.org/attachment.cgi?id=17521 +--- + source4/dsdb/common/util.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c +index 679daa0348b..02472f8a89c 100644 +--- a/source4/dsdb/common/util.c ++++ b/source4/dsdb/common/util.c +@@ -2442,7 +2442,10 @@ static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX + return NT_STATUS_NO_MEMORY; + } + +- ret = dsdb_autotransaction_request(ldb, req); ++ ret = ldb_request(ldb, req); ++ if (ret == LDB_SUCCESS) { ++ ret = ldb_wait(req->handle, LDB_WAIT_ALL); ++ } + + if (req->context != NULL) { + struct ldb_control *control = talloc_get_type_abort(req->context, +-- +2.35.0 diff --git a/samba.spec b/samba.spec index 0bf17ab..967b48a 100644 --- a/samba.spec +++ b/samba.spec @@ -48,7 +48,7 @@ Name: samba Version: 4.15.3 -Release: 12 +Release: 13 Summary: A suite for Linux to interoperate with Windows License: GPLv3+ and LGPLv3+ @@ -105,6 +105,35 @@ Patch36: backport-0008-CVE-2022-3437.patch Patch37: backport-0009-CVE-2022-3437.patch Patch38: backport-0010-CVE-2022-3437.patch Patch39: backport-0011-CVE-2022-3437.patch +Patch40: backport-0001-CVE-2021-20251.patch +Patch41: backport-0002-CVE-2021-20251.patch +Patch42: backport-0003-CVE-2021-20251.patch +Patch43: backport-0004-CVE-2021-20251.patch +Patch44: backport-0005-CVE-2021-20251.patch +Patch45: backport-0006-CVE-2021-20251.patch +Patch47: backport-0007-CVE-2021-20251.patch +Patch48: backport-0008-CVE-2021-20251.patch +Patch49: backport-0009-CVE-2021-20251.patch +Patch50: backport-0010-CVE-2021-20251.patch +Patch51: backport-0011-CVE-2021-20251.patch +Patch52: backport-0012-CVE-2021-20251.patch +Patch53: backport-0013-CVE-2021-20251.patch +Patch54: backport-0014-CVE-2021-20251.patch +Patch55: backport-0015-CVE-2021-20251.patch +Patch56: backport-0016-CVE-2021-20251.patch +Patch60: backport-0017-CVE-2021-20251.patch +Patch61: backport-0018-CVE-2021-20251.patch +Patch62: backport-0019-CVE-2021-20251.patch +Patch63: backport-0020-CVE-2021-20251.patch +Patch64: backport-0021-CVE-2021-20251.patch +Patch65: backport-0022-CVE-2021-20251.patch +Patch66: backport-0023-CVE-2021-20251.patch +Patch67: backport-0024-CVE-2021-20251.patch +Patch68: backport-0025-CVE-2021-20251.patch +Patch69: backport-0026-CVE-2021-20251.patch +Patch70: backport-0027-CVE-2021-20251.patch +Patch71: backport-0028-CVE-2021-20251.patch +Patch72: backport-0029-CVE-2021-20251.patch BuildRequires: avahi-devel bison dbus-devel docbook-style-xsl e2fsprogs-devel flex gawk gnupg2 gnutls-devel >= 3.4.7 gpgme-devel BuildRequires: jansson-devel krb5-devel >= %{required_mit_krb5} libacl-devel libaio-devel libarchive-devel libattr-devel @@ -3428,6 +3457,12 @@ fi %endif %changelog +* Fri Nov 11 2022 xinghe - 4.15.3-13 +- Type:cves +- ID:CVE-2021-20251 +- SUG:NA +- DESC:fix CVE-2021-20251 + * Wed Oct 26 2022 xinghe - 4.15.3-12 - Type:cves - ID:CVE-2022-3437 -- Gitee