[Pkg-samba-maint] [samba] 03/04: Patches for CVE-2017-15275 and CVE-2017-14746

[Mathieu Parent]

This is an automated email from the git hooks/post-receive script.

sathieu pushed a commit to annotated tag debian/2%4.5.12+dfsg-2+deb9u1
in repository samba.

commit 0ebec89b8e8c778d2067b0c944af747ca6aca436
Author: Mathieu Parent <math.parent at gmail.com>
Date:   Sat Nov 11 13:32:48 2017 +0100

    Patches for CVE-2017-15275 and CVE-2017-14746
    
    (cherry picked from commit 438db971319883e75974f5e945c6fa21179dfedf)
---
 ...in-code-can-return-uninitialized-memory-w.patch | 45 ++++++++++++++++
 ...-SMB1-use-after-free-crash-bug.-CVE-2017-.patch | 63 ++++++++++++++++++++++
 debian/patches/series                              |  2 +
 3 files changed, 110 insertions(+)

diff --git a/debian/patches/s3-smbd-Chain-code-can-return-uninitialized-memory-w.patch b/debian/patches/s3-smbd-Chain-code-can-return-uninitialized-memory-w.patch
new file mode 100644
index 0000000..f0510f9
--- /dev/null
+++ b/debian/patches/s3-smbd-Chain-code-can-return-uninitialized-memory-w.patch
@@ -0,0 +1,45 @@
+From 6dd87a82a733184df3a6f09e020f6a3c2b365ca2 Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra at samba.org>
+Date: Wed, 20 Sep 2017 11:04:50 -0700
+Subject: [PATCH] s3: smbd: Chain code can return uninitialized memory when
+ talloc buffer is grown.
+
+Ensure we zero out unused grown area.
+
+CVE-2017-15275
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=13077
+
+Signed-off-by: Jeremy Allison <jra at samba.org>
+---
+ source3/smbd/srvstr.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/source3/smbd/srvstr.c b/source3/smbd/srvstr.c
+index 56dceba8c6c..c2d70b32c32 100644
+--- a/source3/smbd/srvstr.c
++++ b/source3/smbd/srvstr.c
+@@ -110,6 +110,20 @@ ssize_t message_push_string(uint8_t **outbuf, const char *str, int flags)
+ 		DEBUG(0, ("srvstr_push failed\n"));
+ 		return -1;
+ 	}
++
++	/*
++	 * Ensure we clear out the extra data we have
++	 * grown the buffer by, but not written to.
++	 */
++	if (buf_size + result < buf_size) {
++		return -1;
++	}
++	if (grow_size < result) {
++		return -1;
++	}
++
++	memset(tmp + buf_size + result, '\0', grow_size - result);
++
+ 	set_message_bcc((char *)tmp, smb_buflen(tmp) + result);
+ 
+ 	*outbuf = tmp;
+-- 
+2.14.2.920.gcf0c67979c-goog
+
diff --git a/debian/patches/s3-smbd-Fix-SMB1-use-after-free-crash-bug.-CVE-2017-.patch b/debian/patches/s3-smbd-Fix-SMB1-use-after-free-crash-bug.-CVE-2017-.patch
new file mode 100644
index 0000000..d33d24d
--- /dev/null
+++ b/debian/patches/s3-smbd-Fix-SMB1-use-after-free-crash-bug.-CVE-2017-.patch
@@ -0,0 +1,63 @@
+From 5b2d738fb3e5d40590261702a8e7564a5b0e46d5 Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra at samba.org>
+Date: Tue, 19 Sep 2017 16:11:33 -0700
+Subject: [PATCH] s3: smbd: Fix SMB1 use-after-free crash bug. CVE-2017-14746
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When setting up the chain, always use 'next->' variables
+not the 'req->' one.
+
+Bug discovered by 连一汉 <lianyihan at 360.cn>
+
+CVE-2017-14746
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=13041
+
+Signed-off-by: Jeremy Allison <jra at samba.org>
+---
+ source3/smbd/process.c | 7 ++++---
+ source3/smbd/reply.c   | 5 +++++
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/source3/smbd/process.c b/source3/smbd/process.c
+index b65ae2c1b1c..9b2b0a669a2 100644
+--- a/source3/smbd/process.c
++++ b/source3/smbd/process.c
+@@ -1855,12 +1855,13 @@ void smb_request_done(struct smb_request *req)
+ 
+ 		next->vuid = SVAL(req->outbuf, smb_uid);
+ 		next->tid  = SVAL(req->outbuf, smb_tid);
+-		status = smb1srv_tcon_lookup(req->xconn, req->tid,
++		status = smb1srv_tcon_lookup(req->xconn, next->tid,
+ 					     now, &tcon);
++
+ 		if (NT_STATUS_IS_OK(status)) {
+-			req->conn = tcon->compat;
++			next->conn = tcon->compat;
+ 		} else {
+-			req->conn = NULL;
++			next->conn = NULL;
+ 		}
+ 		next->chain_fsp = req->chain_fsp;
+ 		next->inbuf = req->inbuf;
+diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
+index 7b07078249b..81acedf0413 100644
+--- a/source3/smbd/reply.c
++++ b/source3/smbd/reply.c
+@@ -923,6 +923,11 @@ void reply_tcon_and_X(struct smb_request *req)
+ 		}
+ 
+ 		TALLOC_FREE(tcon);
++		/*
++		 * This tree id is gone. Make sure we can't re-use it
++		 * by accident.
++		 */
++		req->tid = 0;
+ 	}
+ 
+ 	if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
+-- 
+2.14.2.920.gcf0c67979c-goog
+
diff --git a/debian/patches/series b/debian/patches/series
index 1289ae8..c7befd5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -19,3 +19,5 @@ provision-Update-root-DNS-servers-list.patch
 CVE-2017-12150-v4-5.patches.metze02.txt
 CVE-2017-12151-v4-5.patches.metze02.txt
 CVE-2017-12163-all-metze01.patch.txt
+s3-smbd-Chain-code-can-return-uninitialized-memory-w.patch
+s3-smbd-Fix-SMB1-use-after-free-crash-bug.-CVE-2017-.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git