REDHAT-BUG-2552136: High severity Samba Samba vulnerability
On shares using the vfscephrgw module, the module's openat() implementation ignored the (possibly case-corrected) filename supplied by the file server and instead re-opened the name originally sent by the client.
When a client opened an existing file using a different case than it exists on disk with a create disposition of FILEOPENIF, the case-insensitive lookup failed inside the module. The file server then treated the request as a file creation, checking only the caller's permission to add a file to the parent directory and skipping the access check on the existing object. The subsequent open then collided with, and re-opened, the existing object.
As a result an authenticated user could read or overwrite files owned by another user, despite those files having restrictive permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can access a share using the vfs_ceph_rgw module can exploit it. The user must be able to add a file to the parent directory, but does not need permission to read or modify the existing target file.
What request conditions are required for exploitation?
The attacker must open an existing file using a differently cased filename and use the FILE_OPEN_IF create disposition. The case-insensitive lookup must cause the file server to supply a case-corrected name that differs from the client-provided name.
What is the impact if exploitation succeeds?
The attacker can cause the existing object to be reopened after the server checks only permission to create a file in its parent directory. This can allow reading or overwriting another user's file despite restrictive permissions on that file.