[Pkg-samba-maint] [Git][samba-team/samba][master] 49 commits: CVE-2026-6949: ndr_dns: let ndr_pull_dns_res_rec() remember the start offset
Michael Tokarev (@mjt)
gitlab at salsa.debian.org
Thu Aug 13 17:16:42 BST 2026
Michael Tokarev pushed to branch master at Debian Samba Team / samba
Commits:
36108895 by Stefan Metzmacher at 2026-07-28T10:46:39+00:00
CVE-2026-6949: ndr_dns: let ndr_pull_dns_res_rec() remember the start offset
In order to verify TSIG signatures we need a reliable way to
truncate the original dns_name_packet buffer before the
last additional dns_res_rec.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
d003e6f3 by Stefan Metzmacher at 2026-07-28T10:46:39+00:00
CVE-2026-6949: s4:dns_server: correctly truncate the buffer for TSIG verification
Calculating the length of the TSIG additional dns_res_rec,
via ndr_push_dns_res_rec() is fragile and may generate
a buffer larger than the original dns_name_packet buffer.
This could underflow the resulting packet_len,
to a very large value and buffer_len to a small value.
Resulting in a memcpy() of a very large size into
a very small buffer. This most likely already
gets a segmentation fault when reading after the
in->data.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
006aa7f1 by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Protocol field lengths need to be validated to avoid attempts to
access memory beyond the end of the packet buffer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Tristan Madani <tristan at talencesecurity.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
0954199e by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed. Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Martin Schwenke <mschwenke at ddn.com>
Reported-by: Also Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
efeb84e1 by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out-of-bounds data access
Do not allow the VNN map's size to extend past the end of the buffer.
This is checked by switching to ctdb_vnn_map_pull(), which also
simplifies the code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
559cedfd by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
If a NUL terminator doesn't appear in the buffer then the database
name is not a valid string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
82c81cfe by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the recdata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
d3b3de06 by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the indata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
9771cced by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The first check is clearly needed because m->db_id is referenced. The
second check is handled by a similar update to
ctdb_control_update_record(), but repeat it in case something else
changes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
8b5fc74b by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Instead of checking only that there is enough data for the length
field, check there is enough data for the entire header part of the
struct. After cross-checking overall lengths, ensure there is enough
data for the key/data in the data element.
While here, modernise the DEBUG.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 13)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
edc0d81e by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled
As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.
Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer. However, include
this fix here for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 16)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
db9f000a by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-protocol: Always pull the specified number of bytes
The string should not contain a premature NUL terminator, which would
cause less than the specified number of bytes to be pulled. If it
does, consume the specified number of bytes anyway. The alternative
doesn't make sense.
Note that this is unlikely to be a security issue, where trailing data
in the string field causes the buffer to be overrun. That would
require an additional protocol bug. However, include this fix here
for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
e9b205b9 by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
1b45e584 by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
d658c91b by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-common: Secure sock_daemon Unix domain sockets
Currently, the mode of the socket depends on the creating process's
umask. This might allow unwanted access.
It might be preferable to do this just for the eventd socket.
However, there is no useful place to hook this in outside of
sock_daemon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
49051f57 by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-doc: Emphasise that the private network must be private
Note that the difference in the first couple of lines is leading
whitespace being switch to a TAB.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
8c2c895f by Martin Schwenke at 2026-07-28T10:46:39+00:00
CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports
We can't deal with this in the current CTDB protocol without
disproportionate effort. So, document reality clearly in the code to
try to stop these from being reported.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
d25f3ff0 by Douglas Bagnall at 2026-07-28T10:46:39+00:00
CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob
We were making the enc_data_blob 6 bytes too big.
Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087
Reported-by: Tristan <TristanInSec at gmail.com>
Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
17f202d0 by Volker Lendecke at 2026-07-28T10:46:39+00:00
CVE-2026-58218: dns_server: Fix an error path memleak
We talloc the new key off "dns->tkeys", which is long-lived. On any
error we never free'd that again. Probably not remotely triggerable,
this is only setting up the gensec context.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
0d9ca2c5 by Volker Lendecke at 2026-07-28T10:46:39+00:00
CVE-2026-58218: dns_server: Only add a tkey after successful authentication
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
ba8b6564 by Stefan Metzmacher at 2026-07-28T10:46:39+00:00
CVE-2026-58221: s4:dsdb: provide dsdb_audit_{log_attributes,operation_human_readable}() functions
They are useful outside of audit_log.c soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
3661b112 by Stefan Metzmacher at 2026-07-28T10:46:39+00:00
CVE-2026-58221: s4:dsdb: let rootdse_filter_operations() reject untrusted operations on special DNs
Without this authenticated (also non-admin) users write internal meta
data leading to admin privileges.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
18a2cf6f by Stefan Metzmacher at 2026-07-28T10:46:39+00:00
CVE-2026-58222: s4:ldap_server: don't allow untrusted compare requests for confidential attributes
This means we apply acl checks against the search filter similar
to normal ldb searches.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16148
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
44ba362e by Björn Jacke at 2026-07-28T10:46:39+00:00
WHATSNEW: Add release notes for Samba 4.24.5.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
327a642f by Björn Jacke at 2026-07-28T10:46:39+00:00
VERSION: Disable GIT_SNAPSHOT for the 4.24.5 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
2cb13ac1 by Björn Jacke at 2026-07-28T10:46:39+00:00
VERSION: Bump version up to Samba 4.24.6...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
1247c61c by Martin Schwenke at 2026-07-28T12:14:16+00:00
ctdb-server: Avoid removing connections for released IP
Commit c6602b686b4e50d93272667ef86d3904181fb1ab causes TCP connections
to be cleared whenever an associated client goes away. This shouldn't
happen when the associated public IP is being released, since the
takeover node will need the connection details to send tickle ACKs.
Sorry, I missed this when reviewing that commit.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15994
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Martin Schwenke <martins at samba.org>
Autobuild-Date(master): Wed Apr 29 02:58:12 UTC 2026 on atb-devel-224
(cherry picked from commit 9351c9f3b5a57239a7fbdd818e8ab72ecc469d9d)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Tue Jul 28 12:14:16 UTC 2026 on atb-devel-224
- - - - -
376df42e by Stefan Metzmacher at 2026-07-28T16:39:31+02:00
Merge tag 'samba-4.24.5' into v4-24-test
samba: tag release samba-4.24.5
- - - - -
f65fc970 by Martin Schwenke at 2026-07-29T11:08:15+00:00
ctdb-recoverd: Strengthen check for cluster lock held
This avoids attempting to start recovery without holding the cluster
lock.
There seems to be only one way the following can happen:
2026-05-12T12:15:51.127992+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:51.128019+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:51.128192+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:15:51.135578+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:15:51.135590+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:16:13.094308+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:16:13.094362+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:16:13.094582+05:30 nsds1 ctdb-recoverd[826]: do_recovery: Starting do_recovery
2026-05-12T12:16:13.094591+05:30 nsds1 ctdb-recoverd[826]: Cluster lock not held - abort recovery, ban node
2026-05-12T12:16:13.094596+05:30 nsds1 ctdb-recoverd[826]: Banning node 0 for 300 seconds
2026-05-12T12:16:13.094612+05:30 nsds1 ctdbd[700]: Banning this node for 300 seconds
_cluster_lock_lock() sets rec->cluster_lock_handle during an attempt
to take the cluster look. This function contains a nested event loop
where other things can happen. Presumably the 3rd leader broadcast
timeout above occurs, starting a nested election (which also needs to
be avoided - this is the real root cause). cluster_lock_election()
then presumably finds that cluster_lock_held() returns true and sets
the leader to the current node.
However, the check in cluster_lock_held() is too weak and the "locked"
element must also be checked. As noted above, the nested elections
are the real issue but this is a belts-and-braces fix that should be
in place to avoid weirdness due to the nested event loop.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16152
Reported-by: Agam S <sagam at ddn.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Amitay Isaacs <amitay at gmail.com>
(cherry picked from commit c3c250c9c8e3385f593e386f91e8579b8c89370a)
- - - - -
f26a49e6 by Martin Schwenke at 2026-07-29T11:08:15+00:00
ctdb-recoverd: Do not allow nested elections
This appears to show nested elections:
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
There is no sign that the first election ended. Starting another one
causes bad state interactions. Apart from causing confusion for
multiple pieces of state (e.g. rec->election_in_progress), a nested
call to _cluster_lock_lock() will leak rec->cluster_lock_handle
because it will overwrite it with the new in-progress handle.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16152
Reported-by: Agam S <sagam at ddn.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Amitay Isaacs <amitay at gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay at samba.org>
Autobuild-Date(master): Thu Jul 9 15:24:42 UTC 2026 on atb-devel-224
(cherry picked from commit d28f8ed17c867f306ca900bd912e8b75c5c7be8b)
- - - - -
00b04468 by Anoop C S at 2026-07-29T11:08:15+00:00
vfs_ceph_new: Include proxy setting in mount cache cookie
The mount cache cookie is derived from (conf_file/user_id/fsname) but
does not include the proxy mode. When two shares differ only in their
proxy setting, they produce the same cookie and share a single cached
ceph_mount_info. Since libcephfs.so and libcephfs_proxy.so define
struct ceph_mount_info with entirely different layouts, calling a
function resolved from one library on a mount allocated by the other
causes a segfault.
Add config->proxy to the cookie so that mounts created by different
libraries are never shared.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16186
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: John Mulligan <jmulligan at redhat.com>
Reviewed-by: Guenther Deschner <gd at samba.org>
Autobuild-User(master): Anoop C S <anoopcs at samba.org>
Autobuild-Date(master): Fri Jul 24 15:56:49 UTC 2026 on atb-devel-224
(cherry picked from commit a1881f96f7309411087c3b4b3fe9db964a5ef644)
- - - - -
0fa4d138 by Stefan Metzmacher at 2026-07-29T11:08:15+00:00
s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
(cherry picked from commit 3b7730b3702875d92b5dc0e90410ae26c7355138)
- - - - -
6d174ef3 by Stefan Metzmacher at 2026-07-29T12:12:01+00:00
s4:cracknames: make consistent use of ldb_binary_encode_string()
A client provided value can be passed into a filter
without going through ldb_binary_encode_string()
But the value is only appended via a to "name=%s",
so there's no leading "(", which means
in lib/ldb/common/ldb_parse.c:356: the value-parsing loop terminates
at the first unescaped ')', so a payload like "users)(hidden=*" collapses to
"(name=users)" with the trailing bytes silently discarded. An escaped "\)" makes
ldb_parse_tree() return NULL rather than admit injection. Combined with
LDB_SCOPE_ONELEVEL, the attribute list restricted to ["name"], and the fact that
a DRSUAPI-authenticated client can already issue arbitrary LDAP searches via
dcesrv_samdb_connect_as_user(), there is no escalation surface.
So this is only hardening helping AI to avoid reporting
false positives.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16094
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
(cherry picked from commit a7a5de8d951969d60a7f0c40798fc97f6ee873fa)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Wed Jul 29 12:12:01 UTC 2026 on atb-devel-224
- - - - -
d13c39c1 by Michael Tokarev at 2026-08-04T00:56:53+03:00
Convert upstream signing-key to ascii
- - - - -
a2e0beed by Matthias Grandl at 2026-08-11T18:16:21+00:00
vfs_ceph_snapshots: Fix panic on snapshot access with a "/"-rooted share
ceph_snap_gmt_convert_dir() builds an absolute snapshot path by joining
the share's connectpath, the request-relative name and the snapshot
subdir with '/' separators, then hands it to OpenDir(). OpenDir() ->
fd_openat() -> filename_convert_dirfsp_rel() splits the path on '/' and
openat_pathref_fsp_nosymlink() asserts that no component is empty:
SMB_ASSERT(rel_fname.base_name[0] != '\0') source3/smbd/files.c:1212
connectpath is a bare "/" when the share is mounted at the file system
root, so the join yields a leading "//" (e.g. "//.snap" or
"//dir/.snap"). That empty first component trips the assert and panics
smbd as soon as a snapshot is accessed.
Whether the malformed path actually reaches the assert also depends on
the Ceph client accepting a non-canonical "//" path in the preceding
stat(), so the panic is libcephfs-version dependent.
Canonicalize the .snap directory path with canonicalize_absolute_path()
after building it, so the path handed to OpenDir() is always canonical
and the empty leading component can no longer occur.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16176
Signed-off-by: Matthias Grandl <matthias.grandl at croit.io>
Reviewed-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: David Disseldorp ddiss at samba.org
Autobuild-User(master): Anoop C S <anoopcs at samba.org>
Autobuild-Date(master): Tue Jul 21 16:12:18 UTC 2026 on atb-devel-224
(cherry picked from commit abb48aacbd994877006bf9156e633d3cf29a34bc)
- - - - -
2ec6b2cf by Volker Lendecke at 2026-08-11T18:16:21+00:00
lib: Fix undefined behaviour at fork time in pthreadpool
If a pthread times out at the same time with a fork, ETIMEDOUT is
overwritten and not being taken care of. This means that we can race
with the forking thread destroying pool->condvar in the next round of
the thread's while(1) loop. pthread_cond_wait() on a condition
variable that has been destroyed is not a good idea.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16191
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Thu Jul 30 17:51:29 UTC 2026 on atb-devel-224
(cherry picked from commit a13764ecad804539c8cad8ec84b41ef437fab4ac)
- - - - -
692e4184 by Stefan Metzmacher at 2026-08-11T18:16:21+00:00
s3:libsmb: let dsgetdcname_rediscover() try process_dc_dns() before process_dc_netbios()
It's 2026 we typically have AD domains, and most of the time no nmbd
running.
So we should try CLDAP before falling back name_status_find(),
this allows us to detect that the domain is an AD domain even if
we searched with the netbios domain name.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16153
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Thu Jul 2 09:33:10 UTC 2026 on atb-devel-224
(cherry picked from commit 8bd496bf937d3a38482943e973a196f2c1f902a9)
- - - - -
22a00a2c by Ralph Boehme at 2026-08-11T18:16:21+00:00
s4/torture: add torture_smb2_connection_share_ext()
Takes an additional share paramter compared to torture_smb2_connection_ext().
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
(cherry picked from commit a6d8c56ccc6d3d0cd714fa90f0c3fa54e2231eb0)
[metze at samba.org] Backported in order to let the patches for bug 16065
apply cleanly.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
fda66e42 by Stefan Metzmacher at 2026-08-11T18:16:21+00:00
s4:py_net: make use of self->libnet_ctx->resolve_ctx
There's no need to call lpcfg_resolve_context() every time again.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit f5f80e04406b6f8e0cf810d7fd3d015e4e455051)
- - - - -
1c1f97e4 by Stefan Metzmacher at 2026-08-11T18:16:21+00:00
s4:libcli/resolve: let lpcfg_resolve_context() take an explicit mem_ctx
This avoids memory leaks in various places.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Sat Aug 1 09:11:02 UTC 2026 on atb-devel-224
(cherry picked from commit 44008810a4b81baa9cbf63f0960ae1310afbb2a0)
- - - - -
c3c21e04 by Ralph Boehme at 2026-08-11T18:16:21+00:00
selftest: mark "smb2.lease.two-leases" as flapping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15978
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Björn Jacke <bjacke at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit df4271a19664fbb59a83d9d256cfa9e71836678d)
- - - - -
4906c4d4 by Stefan Metzmacher at 2026-08-11T18:16:21+00:00
selftest: mark RpcdWitnessSambaTests as flapping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16077
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit a871fae0b94fae5b052f14ae06cf3400b4a0ef33)
- - - - -
71c1e9f2 by Stefan Metzmacher at 2026-08-11T19:19:29+00:00
python/tests: catch NT_STATUS_IO_TIMEOUT from witness.witness() as AssertionError()
This way it's actually possible to mark it as flapping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16077
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Björn Jacke <bjacke at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Mon Aug 10 16:42:23 UTC 2026 on atb-devel-224
(cherry picked from commit f16269a6fc586071da81052ee4e76827e5b774be)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Tue Aug 11 19:19:29 UTC 2026 on atb-devel-224
- - - - -
453e1622 by Stefan Metzmacher at 2026-08-12T22:47:59+00:00
librpc/ndr: fix ndr_{push,pull,print}_{timeval,timespec}() and add _legacy() compat
Scalar types should do nothing when called with NDR_BUFFERS,
the current timeval and timespec encode the values twice.
In order to keep compat with the former behavior we have
timeval_legacy and timespec_legacy.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16199
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 270c2451b541d6457d17b5eeccaafd32636b4591)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Wed Aug 12 22:47:59 UTC 2026 on atb-devel-224
- - - - -
94ca0ffe by Björn Jacke at 2026-08-13T16:22:15+02:00
WHATSNEW: Add release notes for Samba 4.24.6.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
f6577b76 by Björn Jacke at 2026-08-13T16:22:54+02:00
VERSION: Disable GIT_SNAPSHOT for the 4.24.6 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
8a422721 by Michael Tokarev at 2026-08-13T19:12:05+03:00
New upstream version 4.24.6+dfsg
- - - - -
6cfaaff3 by Michael Tokarev at 2026-08-13T19:12:20+03:00
Update upstream source from tag 'upstream/4.24.6+dfsg'
Update to upstream version '4.24.6+dfsg'
with Debian dir 515650e1823515a9c12f6239c548e44e9c7ec4f9
- - - - -
b01ac367 by Michael Tokarev at 2026-08-13T19:15:15+03:00
update changelog; upload version 4.24.6+dfsg-1 to unstable
- - - - -
71 changed files:
- VERSION
- WHATSNEW.txt
- ctdb/server/ctdb_recoverd.c
- ctdb/server/ctdb_takeover.c
- debian/changelog
- debian/upstream/signing-key.asc
- lib/pthreadpool/pthreadpool.c
- libcli/echo/tests/echo.c
- + librpc/ABI/ndr-6.1.0.sigs
- librpc/idl/misc.idl
- librpc/ndr/libndr.h
- librpc/ndr/ndr_basic.c
- librpc/wscript_build
- nsswitch/libwbclient/tests/wbclient.c
- python/samba/tests/blackbox/rpcd_witness_samba_only.py
- selftest/flapping.d/smb2.lease
- + selftest/flapping.d/witness
- source3/librpc/idl/open_files.idl
- source3/libsmb/dsgetdcname.c
- source3/modules/vfs_ceph_new.c
- source3/modules/vfs_ceph_snapshots.c
- source3/rpc_server/dfs/srv_dfs_nt.c
- source4/client/cifsdd.c
- source4/client/client.c
- source4/dsdb/ft_scanner/ft_scanner_tdos.c
- source4/dsdb/samdb/cracknames.c
- source4/kdc/kdc-proxy.c
- source4/lib/policy/gp_filesys.c
- source4/libcli/ldap/ldap_client.c
- source4/libcli/resolve/resolve_lp.c
- source4/libnet/libnet.c
- source4/libnet/libnet_site.c
- source4/libnet/py_net.c
- source4/librpc/rpc/dcerpc_connect.c
- source4/ntvfs/cifs/vfs_cifs.c
- source4/torture/basic/base.c
- source4/torture/basic/misc.c
- source4/torture/drs/rpc/dssync.c
- source4/torture/gentest.c
- source4/torture/ldap/cldap.c
- source4/torture/ldap/cldapbench.c
- source4/torture/ldap/netlogon.c
- source4/torture/libnet/libnet_BecomeDC.c
- source4/torture/locktest.c
- source4/torture/masktest.c
- source4/torture/nbt/dgram.c
- source4/torture/nbt/nbt.c
- source4/torture/raw/composite.c
- source4/torture/raw/lockbench.c
- source4/torture/raw/openbench.c
- source4/torture/raw/oplock.c
- source4/torture/raw/session.c
- source4/torture/raw/tconrate.c
- source4/torture/rpc/fsrvp.c
- source4/torture/rpc/iremotewinspool_driver.c
- source4/torture/rpc/join.c
- source4/torture/rpc/lsa.c
- source4/torture/rpc/samba3rpc.c
- source4/torture/rpc/spoolss.c
- source4/torture/smb2/credits.c
- source4/torture/smb2/durable_open.c
- source4/torture/smb2/ioctl.c
- source4/torture/smb2/multichannel.c
- source4/torture/smb2/oplock.c
- source4/torture/smb2/replay.c
- source4/torture/smb2/scan.c
- source4/torture/smb2/session.c
- source4/torture/smb2/util.c
- source4/torture/unix/unix_info2.c
- source4/torture/unix/whoami.c
- source4/torture/util_smb.c
The diff was not included because it is too large.
View it on GitLab: https://salsa.debian.org/samba-team/samba/-/compare/e265ca1ad77bb839cf3ee1d97d5a279bcddc813a...b01ac367657727d030c360827247f452f03853e2
--
View it on GitLab: https://salsa.debian.org/samba-team/samba/-/compare/e265ca1ad77bb839cf3ee1d97d5a279bcddc813a...b01ac367657727d030c360827247f452f03853e2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-samba-maint/attachments/20260813/1e9ece51/attachment-0001.htm>
More information about the Pkg-samba-maint
mailing list