From 4732c6abd78166ecb9379ab4bab110f4e6f4409c Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 5 Feb 2026 20:24:12 +0100 Subject: [PATCH 1/2] CVE-2026-1933 tests: Fix permissions used for creating reparse points SEC_STD_ALL does not lead to fsp->access_mask to include the required bits. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992 Signed-off-by: Volker Lendecke Reviewed-by: Stefan Metzmacher --- python/samba/tests/smb3unix.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/samba/tests/smb3unix.py b/python/samba/tests/smb3unix.py index 66aa98b5aa9..5388b7f0ee2 100644 --- a/python/samba/tests/smb3unix.py +++ b/python/samba/tests/smb3unix.py @@ -408,7 +408,7 @@ class Smb3UnixTests(samba.tests.libsmb.LibsmbTests): tag = 0x80000025 f,_,cc_out = c.create_ex('\\reparse', - DesiredAccess=security.SEC_STD_ALL, + DesiredAccess=security.SEC_FILE_WRITE_ATTRIBUTE, CreateDisposition=libsmb.FILE_CREATE, CreateContexts=[posix_context(0o600)]) @@ -421,7 +421,7 @@ class Smb3UnixTests(samba.tests.libsmb.LibsmbTests): c.close(f) f,_,cc_out = c.create_ex('\\reparse', - DesiredAccess=security.SEC_STD_ALL, + DesiredAccess=security.SEC_FILE_WRITE_ATTRIBUTE, CreateDisposition=libsmb.FILE_OPEN, CreateContexts=[posix_context(0o600)]) c.close(f) -- 2.43.0 From 26942b899203b052b17e07d5190434f89fb79f8f Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 2 Feb 2026 11:43:37 +0100 Subject: [PATCH 2/2] CVE-2026-1933 smbd: Add access checks to reparse point operations On a share marked "read only = yes" and on file handles opened R/O users can set or delete the reparse point xattrs on files that the user has write-access in the file system for. Add the required access checks. Thanks to Asim Viladi Oglu Manizada for reporting the issue. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992 Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke --- source3/modules/util_reparse.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/source3/modules/util_reparse.c b/source3/modules/util_reparse.c index 2694410be4f..74b594a2d6d 100644 --- a/source3/modules/util_reparse.c +++ b/source3/modules/util_reparse.c @@ -276,6 +276,14 @@ NTSTATUS fsctl_set_reparse_point(struct files_struct *fsp, return NT_STATUS_ACCESS_DENIED; } + if ((fsp->fsp_name->twrp != 0) || + ((fsp->access_mask & + (SEC_FILE_WRITE_DATA | SEC_FILE_WRITE_ATTRIBUTE)) == 0)) + { + DBG_DEBUG("Access denied on a readonly handle\n"); + return NT_STATUS_ACCESS_DENIED; + } + status = reparse_buffer_check(in_data, in_len, &reparse_tag, @@ -346,6 +354,14 @@ NTSTATUS fsctl_del_reparse_point(struct files_struct *fsp, uint32_t dos_mode; int ret; + if ((fsp->fsp_name->twrp != 0) || + ((fsp->access_mask & + (SEC_FILE_WRITE_DATA | SEC_FILE_WRITE_ATTRIBUTE)) == 0)) + { + DBG_DEBUG("Access denied on a readonly handle\n"); + return NT_STATUS_ACCESS_DENIED; + } + status = fsctl_get_reparse_tag(fsp, &existing_tag); if (!NT_STATUS_IS_OK(status)) { return status; -- 2.43.0