Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1941402 (CVE-2021-20277) - CVE-2021-20277 samba: Out of bounds read in AD DC LDAP server
Summary: CVE-2021-20277 samba: Out of bounds read in AD DC LDAP server
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20277
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1941511 1941512 1941513 1941514 1941515 1941516 1941517 1942497 1943149 1962752 1962753
Blocks: 1942875
TreeView+ depends on / blocked
 
Reported: 2021-03-22 05:18 UTC by Huzaifa S. Sidhpurwala
Modified: 2022-04-17 21:14 UTC (History)
14 users (show)

Fixed In Version: samba 4.14.1, samba 4.13.6, samba 4.12.13
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-04-06 17:36:02 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2331 0 None None None 2021-06-08 22:04:16 UTC
Red Hat Product Errata RHSA-2021:2786 0 None None None 2021-07-20 21:23:59 UTC

Description Huzaifa S. Sidhpurwala 2021-03-22 05:18:09 UTC 
As per upstream:

A string in an LDAP attribute that contains multiple consecutive leading spaces can lead to a memmove() of out of bounds memory in ldb_handler_fold().

ldb_handler_fold() is used by case insensitive strings - that is most string attributes - in Active Directory.

As the search expression is normalised prior to matching any potential objects this in turn may crash the LDAP server process handling the request.  It may be possible to leak the out of bounds memory by matching against it, but this is thought to be unlikely.
Comment 1 Huzaifa S. Sidhpurwala 2021-03-22 05:18:12 UTC 
Acknowledgments:

Name: the Samba Project
Upstream: Douglas Bagnall (Catalyst and the Samba Team)
Comment 3 Guilherme de Almeida Suckevicz 2021-03-24 13:17:00 UTC 
Created libldb tracking bugs for this issue:

Affects: fedora-all [bug 1942497]
Comment 4 Huzaifa S. Sidhpurwala 2021-03-24 13:52:32 UTC 
External References:

https://www.samba.org/samba/security/CVE-2021-20277.html
Comment 7 Hardik Vyas 2021-03-25 13:54:11 UTC 
Upstream patch: https://github.com/samba-team/samba/commit/fab6b79b7724f0b636963be528483e3e946884aa
Comment 8 Hardik Vyas 2021-03-26 13:52:34 UTC 
Red Hat Gluster Storage 3 uses built-in version of ldb library in Samba:

$ cat samba.spec
[...]
# RHGS always builds with a private copy of ldb
%global with_internal_ldb 1
[...]
%if ! %with_internal_ldb
%global libldb_version 2.0.8

BuildRequires: libldb-devel >= %{libldb_version}
BuildRequires: python3-ldb-devel >= %{libldb_version}
%endif
[...]
Comment 9 Hardik Vyas 2021-03-26 13:52:43 UTC 
Statement:

The version of Samba shipped with Red Hat Gluster Storage (RHGS) 3 is built with a private copy of ldb (LDAP-like embedded database) library which includes the vulnerable code. However, Samba shipped with RHGS 3 is not supported for use as an Active Directory Domain Controller and hence the impact has been lowered.
Comment 17 errata-xmlrpc 2021-04-06 10:34:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:1072 https://access.redhat.com/errata/RHSA-2021:1072
Comment 18 Product Security DevOps Team 2021-04-06 17:36:02 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20277
Comment 19 errata-xmlrpc 2021-04-14 15:10:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1197 https://access.redhat.com/errata/RHSA-2021:1197
Comment 20 errata-xmlrpc 2021-04-15 11:03:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:1214 https://access.redhat.com/errata/RHSA-2021:1214
Comment 21 errata-xmlrpc 2021-04-15 12:07:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:1213 https://access.redhat.com/errata/RHSA-2021:1213
Comment 23 errata-xmlrpc 2021-06-08 22:04:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:2331 https://access.redhat.com/errata/RHSA-2021:2331
Comment 24 errata-xmlrpc 2021-07-20 21:24:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support

Via RHSA-2021:2786 https://access.redhat.com/errata/RHSA-2021:2786
Note You need to log in before you can comment on or make changes to this bug.