From 2a2b4d0d648a65b326565ae6420f85c9d6419bb4 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 21 Jul 2026 08:49:38 -0400 Subject: [PATCH] import Oracle_OSS sssd-2.12.0-3.0.1.el10_2.1 --- ...ect-path-traversal-in-gpcfilesyspath.patch | 173 ++++++++++++++++++ ...-when-ldap_sudo_search_base-fallback.patch | 78 ++++++++ ...0448-restore-default-debug-sss_cache.patch | 26 +++ sssd.spec | 12 +- 4 files changed, 288 insertions(+), 1 deletion(-) create mode 100644 0004-reject-path-traversal-in-gpcfilesyspath.patch create mode 100644 0005-warn-when-ldap_sudo_search_base-fallback.patch create mode 100644 2002-orabug32810448-restore-default-debug-sss_cache.patch diff --git a/0004-reject-path-traversal-in-gpcfilesyspath.patch b/0004-reject-path-traversal-in-gpcfilesyspath.patch new file mode 100644 index 0000000..869470e --- /dev/null +++ b/0004-reject-path-traversal-in-gpcfilesyspath.patch @@ -0,0 +1,173 @@ +From 3c1a31ab668b1ed7b97eb72d915a4187e549d86c Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov +Date: Thu, 2 Jul 2026 17:29:51 +0200 +Subject: [PATCH] gpo: reject path traversal in gPCFileSysPath +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed +by ad_gpo_extract_smb_components() which converts backslashes to forward +slashes but does not reject ".." path traversal sequences. The resulting +smb_path is used directly in gpo_cache_store_file() to construct a local +filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO +write access to write files outside the cache directory. + +Due to differential path resolution between libsmbclient (which clamps +".." at the SMB share root) and the kernel (which resolves ".." fully), +the SMB download succeeds while the local file write escapes the cache. +On systems with SELinux enforcing, this enables Kerberos configuration +injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t, +writable by sssd_t). On systems without SELinux, this enables arbitrary +file writes including cron job injection for root code execution. + +This patch adds two layers of defense: + +1. Reject ".." as a path component in smb_path at parse time in + ad_gpo_extract_smb_components(). Uses component-aware validation + that checks for "/..", "../", and exact ".." — not substring matching + which would false-positive on legitimate names containing "..". + +2. Validate the resolved cache path stays within GPO_CACHE_PATH in + gpo_cache_store_file() using realpath(), with a trailing-slash + prefix check to prevent prefix-collision attacks (e.g., + /var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache). + +Based on the patch by: Ian Murphy +Amended by: Alexey Tikhonov + +:fixes: CVE-2026-14476 + +Reviewed-by: Sumit Bose +Reviewed-by: Tomáš Halman +(cherry picked from commit ba207eab76ff5253662a763b9b6e9ea42f03d31b) +--- + src/providers/ad/ad_gpo.c | 47 +++++++++++++++++++++++++++++++ + src/providers/ad/ad_gpo_child.c | 49 +++++++++++++++++++++++++++++++++ + 2 files changed, 96 insertions(+) + +diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c +index 952fa49a0e5..4dce4266580 100644 +--- a/src/providers/ad/ad_gpo.c ++++ b/src/providers/ad/ad_gpo.c +@@ -3832,6 +3832,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx, + return ret; + } + ++/* ++ * Check whether a path contains ".." as a path component. ++ * Returns true if traversal is detected, false if the path is safe. ++ * ++ * Checks for: ++ * - "/.." anywhere in the path (component starting with ..) ++ * - "../" at the start of the path ++ * - exact match ".." (path is just "..") ++ * - "/.." at the end of the path ++ * ++ * Does NOT match ".." as a substring of a longer component ++ * (e.g., "my..file" is allowed). ++ */ ++static bool gpo_path_has_traversal(const char *path) ++{ ++ const char *p; ++ ++ if (path == NULL) { ++ return false; ++ } ++ ++ /* Exact match */ ++ if (strcmp(path, "..") == 0) return true; ++ ++ /* Starts with ../ */ ++ if (strncmp(path, "../", 3) == 0) return true; ++ ++ /* Contains /../ or ends with /.. */ ++ p = path; ++ while ((p = strstr(p, "/..")) != NULL) { ++ if (p[3] == '/' || p[3] == '\0') return true; ++ p += 3; ++ } ++ ++ return false; ++} ++ + /* + * This function parses the input_path into its components, replaces each + * back slash ('\') with a forward slash ('/'), and populates the output params. +@@ -3908,6 +3945,16 @@ ad_gpo_extract_smb_components(TALLOC_CTX *mem_ctx, + goto done; + } + ++ /* Reject path traversal. See function comment for what is matched. */ ++ if (gpo_path_has_traversal(smb_path)) { ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "gPCFileSysPath contains path traversal component '..': " ++ "[%s]. Rejecting to prevent cache directory escape.\n", ++ smb_path); ++ ret = EINVAL; ++ goto done; ++ } ++ + *_smb_server = talloc_asprintf(mem_ctx, "%s%s", + SMB_STANDARD_URI, + server_hostname); +diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c +index 592509acf22..e5d7f2128af 100644 +--- a/src/providers/ad/ad_gpo_child.c ++++ b/src/providers/ad/ad_gpo_child.c +@@ -322,6 +322,55 @@ static errno_t gpo_cache_store_file(const char *smb_path, + goto done; + } + ++ /* Defense-in-depth: verify the resolved path stays within the cache ++ * directory (when updating existing files). This catches any bypass ++ * of the ".." check in the parser, including encoding tricks, symlink ++ * attacks, or future regressions. ++ * ++ * The trailing-slash comparison prevents prefix-collision attacks: ++ * without it, a path resolving to "/var/lib/sss/gpo_cache_evil/" ++ * would incorrectly match the prefix "/var/lib/sss/gpo_cache". ++ */ ++ { ++ char *resolved = realpath(filename, NULL); ++ if (resolved != NULL) { ++ /* Resolve GPO_CACHE_PATH too so the comparison works ++ * even when the cache path contains symlinks. */ ++ char *resolved_cache = realpath(GPO_CACHE_PATH, NULL); ++ if (resolved_cache == NULL) { ++ ret = errno; ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "realpath(\"%s\") failed: [%d][%s]\n", ++ GPO_CACHE_PATH, ret, strerror(ret)); ++ free(resolved); ++ goto done; ++ } ++ ++ /* Check that resolved path starts with resolved cache + "/" */ ++ size_t cache_len = strlen(resolved_cache); ++ bool inside = ((strlen(resolved) >= cache_len) && ++ (strncmp(resolved, resolved_cache, cache_len) == 0) && ++ (resolved[cache_len] == '/' || resolved[cache_len] == '\0')); ++ if (!inside) { ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "GPO cache path escapes cache directory: [%s] " ++ "resolves to [%s] which is outside [%s]. " ++ "Rejecting.\n", ++ filename, resolved, resolved_cache); ++ free(resolved_cache); ++ free(resolved); ++ ret = EINVAL; ++ goto done; ++ } ++ free(resolved_cache); ++ free(resolved); ++ } ++ /* If realpath returns NULL, the path doesn't exist yet. ++ * prepare_gpo_cache() will create it — the mkdir calls ++ * are validated by SELinux MAC policy. ++ */ ++ } ++ + tmp_name = talloc_asprintf(tmp_ctx, "%sXXXXXX", filename); + if (tmp_name == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n"); diff --git a/0005-warn-when-ldap_sudo_search_base-fallback.patch b/0005-warn-when-ldap_sudo_search_base-fallback.patch new file mode 100644 index 0000000..109a0ee --- /dev/null +++ b/0005-warn-when-ldap_sudo_search_base-fallback.patch @@ -0,0 +1,78 @@ +From aa74f8b06b974796dfc4760f2363ab78fbb8cc56 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov +Date: Fri, 3 Jul 2026 13:25:08 +0200 +Subject: [PATCH] sudo: warn when ldap_sudo_search_base falls back to root DN +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When ldap_sudo_search_base is not explicitly configured, SSSD falls back +to the domain's naming context (root DN) and searches the entire LDAP +directory tree for sudoRole objects. Any LDAP principal with write access +to any subtree can inject a sudoRole granting arbitrary sudo privileges +on every enrolled host. + +This patch adds a warning log when the fallback occurs, alerting +administrators that their configuration searches the entire directory +tree for sudo rules. A future hardening step would be to default to +ou=sudoers, instead of the root DN. + +The warning approach preserves backwards compatibility while ensuring +administrators are aware of the security implications. + +Based on the patch by: Ian Murphy +Amended by: Alexey Tikhonov + +:fixes: CVE-2026-14474 + +Reviewed-by: Sumit Bose +Reviewed-by: Tomáš Halman +(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d) +--- + src/providers/ldap/sdap.c | 19 +++++++++++++++++++ + src/tests/system/tests/test_ldap.py | 2 +- + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c +index 38a48349633..61c3670c14e 100644 +--- a/src/providers/ldap/sdap.c ++++ b/src/providers/ldap/sdap.c +@@ -1316,6 +1316,25 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse, + + /* Sudo */ + if (!sdom->sudo_search_bases) { ++ /* At some point make this option mandatory, ++ * i.e. disable sudo rules lookup if 'sudo_search_bases' not set. ++ */ ++ DEBUG(SSSDBG_IMPORTANT_INFO, ++ "`ldap_sudo_search_base` is not set. SSSD will search the entire " ++ "directory tree (%s) for sudoRole objects. This may allow any " ++ "LDAP principal with write access to any subtree to inject " ++ "sudo rules granting arbitrary privileges. Set " ++ "`ldap_sudo_search_base` to restrict the search scope " ++ "(e.g., 'ou=sudoers,dc=example,dc=com').\n", ++ sdom->naming_context); ++ sss_log(SSS_LOG_ALERT, ++ "`ldap_sudo_search_base` is not set. SSSD will search the entire " ++ "directory tree (%s) for sudoRole objects. This may allow any " ++ "LDAP principal with write access to any subtree to inject " ++ "sudo rules granting arbitrary privileges. Set " ++ "`ldap_sudo_search_base` to restrict the search scope " ++ "(e.g., 'ou=sudoers,dc=example,dc=com').", ++ sdom->naming_context); + ret = sdap_set_search_base(opts, sdom, + SDAP_SUDO_SEARCH_BASE, + sdom->naming_context); +diff --git a/src/tests/tests/system/tests/test_ldap.py b/src/tests/tests/system/tests/test_ldap.py +index 9e21d73f639..36d98847563 100644 +--- a/src/tests/tests/system/tests/test_ldap.py ++++ b/src/tests/tests/system/tests/test_ldap.py +@@ -245,7 +245,7 @@ def test_ldap__search_base_is_discovered_and_defaults_to_root_dse(client: Client + client.sssd.dom("test")["ldap_search_base"] = ldap.ldap.naming_context + + client.sssd.stop() +- client.sssd.clear() ++ client.sssd.clear(logs=True) + client.sssd.start() + + assert client.auth.ssh.password("puser1", "Secret123"), "User 'puser1' login failed!" diff --git a/2002-orabug32810448-restore-default-debug-sss_cache.patch b/2002-orabug32810448-restore-default-debug-sss_cache.patch new file mode 100644 index 0000000..0d56be5 --- /dev/null +++ b/2002-orabug32810448-restore-default-debug-sss_cache.patch @@ -0,0 +1,26 @@ +From: Alex Burmashev +Date: Tue, 04 May 2021 13:31:41 +0100 +Subject: [PATCH] restore default debug level for sss_cache + +We want only fatal failures to be logged, otherwise in some conditions log is. +flooded with unneeded "errors" + +Resolves: https://github.com/SSSD/sssd/issues/5488 + +Orabug: 32810448 +Signed-off-by: Alex Burmashev + +Patch migrated from ol8 to ol9 without any modification +Signed-off-by: Darren Archibald +diff -uNr a/src/tools/sss_cache.c b/src/tools/sss_cache.c +--- a/src/tools/sss_cache.c 2024-06-26 02:11:39.000000000 -0700 ++++ b/src/tools/sss_cache.c 2024-09-05 16:17:12.686336046 -0700 +@@ -722,7 +722,7 @@ + struct cache_tool_ctx *ctx = NULL; + int idb = INVALIDATE_NONE; + struct input_values values = { 0 }; +- int debug = SSSDBG_TOOLS_DEFAULT; ++ int debug = SSSDBG_FATAL_FAILURE; + errno_t ret = EOK; + + poptContext pc = NULL; diff --git a/sssd.spec b/sssd.spec index 9369315..5e3d564 100644 --- a/sssd.spec +++ b/sssd.spec @@ -21,17 +21,20 @@ Name: sssd Version: 2.12.0 -Release: 3%{?dist} +Release: 3.0.1%{?dist}.1 Summary: System Security Services Daemon License: GPL-3.0-or-later URL: https://github.com/SSSD/sssd/ Source0: https://github.com/SSSD/sssd/releases/download/2.12.0/sssd-2.12.0.tar.gz Source1: sssd.sysusers +Patch2002: 2002-orabug32810448-restore-default-debug-sss_cache.patch ### Patches ### Patch1: 0001-do-not-require-GID-for-non-POSIX-group.patch Patch2: 0002-fix-use-after-free-in-kcm_read_options.patch Patch3: 0003-do-not-update-cache-timeout-if-member-is-added.patch +Patch4: 0004-reject-path-traversal-in-gpcfilesyspath.patch +Patch5: 0005-warn-when-ldap_sudo_search_base-fallback.patch ### Dependencies ### @@ -1090,6 +1093,13 @@ fi %systemd_postun_with_restart sssd.service %changelog +* Mon Jul 20 2026 EL Errata - 2.12.0-3.0.1.el10_2.1 +- Restore default debug level for sss_cache [Orabug: 32810448] + +* Wed Jul 8 2026 - Tomas Halman - 2.12.0-3.1 +- Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole +- Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass + * Tue Apr 14 2026 Tomas Halman - 2.12.0-3 - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified