diff --git a/0003-gpo-reject-path-traversal-in-gPCFileSysPath.patch b/0003-gpo-reject-path-traversal-in-gPCFileSysPath.patch new file mode 100644 index 0000000..a6f7787 --- /dev/null +++ b/0003-gpo-reject-path-traversal-in-gPCFileSysPath.patch @@ -0,0 +1,176 @@ +From 91017d89f44da47ae16c140e94a5bcafc43badb5 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov +Date: Thu, 2 Jul 2026 17:29:51 +0200 +Subject: [PATCH 1/2] gpo: reject path traversal in gPCFileSysPath +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed +by ad_gpo_extract_smb_components() which converts backslashes to forward +slashes but does not reject ".." path traversal sequences. The resulting +smb_path is used directly in gpo_cache_store_file() to construct a local +filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO +write access to write files outside the cache directory. + +Due to differential path resolution between libsmbclient (which clamps +".." at the SMB share root) and the kernel (which resolves ".." fully), +the SMB download succeeds while the local file write escapes the cache. +On systems with SELinux enforcing, this enables Kerberos configuration +injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t, +writable by sssd_t). On systems without SELinux, this enables arbitrary +file writes including cron job injection for root code execution. + +This patch adds two layers of defense: + +1. Reject ".." as a path component in smb_path at parse time in + ad_gpo_extract_smb_components(). Uses component-aware validation + that checks for "/..", "../", and exact ".." — not substring matching + which would false-positive on legitimate names containing "..". + +2. Validate the resolved cache path stays within GPO_CACHE_PATH in + gpo_cache_store_file() using realpath(), with a trailing-slash + prefix check to prevent prefix-collision attacks (e.g., + /var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache). + +Based on the patch by: Ian Murphy +Amended by: Alexey Tikhonov + +:fixes: CVE-2026-14476 + +Reviewed-by: Sumit Bose +Reviewed-by: Tomáš Halman +(cherry picked from commit ba207eab76ff5253662a763b9b6e9ea42f03d31b) +--- + src/providers/ad/ad_gpo.c | 47 +++++++++++++++++++++++++++++++ + src/providers/ad/ad_gpo_child.c | 49 +++++++++++++++++++++++++++++++++ + 2 files changed, 96 insertions(+) + +diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c +index 82c6e73a0..4a4d21d45 100644 +--- a/src/providers/ad/ad_gpo.c ++++ b/src/providers/ad/ad_gpo.c +@@ -3838,6 +3838,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx, + return ret; + } + ++/* ++ * Check whether a path contains ".." as a path component. ++ * Returns true if traversal is detected, false if the path is safe. ++ * ++ * Checks for: ++ * - "/.." anywhere in the path (component starting with ..) ++ * - "../" at the start of the path ++ * - exact match ".." (path is just "..") ++ * - "/.." at the end of the path ++ * ++ * Does NOT match ".." as a substring of a longer component ++ * (e.g., "my..file" is allowed). ++ */ ++static bool gpo_path_has_traversal(const char *path) ++{ ++ const char *p; ++ ++ if (path == NULL) { ++ return false; ++ } ++ ++ /* Exact match */ ++ if (strcmp(path, "..") == 0) return true; ++ ++ /* Starts with ../ */ ++ if (strncmp(path, "../", 3) == 0) return true; ++ ++ /* Contains /../ or ends with /.. */ ++ p = path; ++ while ((p = strstr(p, "/..")) != NULL) { ++ if (p[3] == '/' || p[3] == '\0') return true; ++ p += 3; ++ } ++ ++ return false; ++} ++ + /* + * This function parses the input_path into its components, replaces each + * back slash ('\') with a forward slash ('/'), and populates the output params. +@@ -3914,6 +3951,16 @@ ad_gpo_extract_smb_components(TALLOC_CTX *mem_ctx, + goto done; + } + ++ /* Reject path traversal. See function comment for what is matched. */ ++ if (gpo_path_has_traversal(smb_path)) { ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "gPCFileSysPath contains path traversal component '..': " ++ "[%s]. Rejecting to prevent cache directory escape.\n", ++ smb_path); ++ ret = EINVAL; ++ goto done; ++ } ++ + *_smb_server = talloc_asprintf(mem_ctx, "%s%s", + SMB_STANDARD_URI, + server_hostname); +diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c +index 4ad0fcf48..5b3d4fcfb 100644 +--- a/src/providers/ad/ad_gpo_child.c ++++ b/src/providers/ad/ad_gpo_child.c +@@ -321,6 +321,55 @@ static errno_t gpo_cache_store_file(const char *smb_path, + goto done; + } + ++ /* Defense-in-depth: verify the resolved path stays within the cache ++ * directory (when updating existing files). This catches any bypass ++ * of the ".." check in the parser, including encoding tricks, symlink ++ * attacks, or future regressions. ++ * ++ * The trailing-slash comparison prevents prefix-collision attacks: ++ * without it, a path resolving to "/var/lib/sss/gpo_cache_evil/" ++ * would incorrectly match the prefix "/var/lib/sss/gpo_cache". ++ */ ++ { ++ char *resolved = realpath(filename, NULL); ++ if (resolved != NULL) { ++ /* Resolve GPO_CACHE_PATH too so the comparison works ++ * even when the cache path contains symlinks. */ ++ char *resolved_cache = realpath(GPO_CACHE_PATH, NULL); ++ if (resolved_cache == NULL) { ++ ret = errno; ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "realpath(\"%s\") failed: [%d][%s]\n", ++ GPO_CACHE_PATH, ret, strerror(ret)); ++ free(resolved); ++ goto done; ++ } ++ ++ /* Check that resolved path starts with resolved cache + "/" */ ++ size_t cache_len = strlen(resolved_cache); ++ bool inside = ((strlen(resolved) >= cache_len) && ++ (strncmp(resolved, resolved_cache, cache_len) == 0) && ++ (resolved[cache_len] == '/' || resolved[cache_len] == '\0')); ++ if (!inside) { ++ DEBUG(SSSDBG_CRIT_FAILURE, ++ "GPO cache path escapes cache directory: [%s] " ++ "resolves to [%s] which is outside [%s]. " ++ "Rejecting.\n", ++ filename, resolved, resolved_cache); ++ free(resolved_cache); ++ free(resolved); ++ ret = EINVAL; ++ goto done; ++ } ++ free(resolved_cache); ++ free(resolved); ++ } ++ /* If realpath returns NULL, the path doesn't exist yet. ++ * prepare_gpo_cache() will create it — the mkdir calls ++ * are validated by SELinux MAC policy. ++ */ ++ } ++ + tmp_name = talloc_asprintf(tmp_ctx, "%sXXXXXX", filename); + if (tmp_name == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n"); +-- +2.54.0 + diff --git a/0004-sudo-warn-when-ldap_sudo_search_base-falls-back-to-root-DN.patch b/0004-sudo-warn-when-ldap_sudo_search_base-falls-back-to-root-DN.patch new file mode 100644 index 0000000..db48ba7 --- /dev/null +++ b/0004-sudo-warn-when-ldap_sudo_search_base-falls-back-to-root-DN.patch @@ -0,0 +1,82 @@ +From 71f52c4a112b9a2e0e07b348ce28170cc673d532 Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov +Date: Fri, 3 Jul 2026 13:25:08 +0200 +Subject: [PATCH 2/2] sudo: warn when ldap_sudo_search_base falls back to root + DN +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When ldap_sudo_search_base is not explicitly configured, SSSD falls back +to the domain's naming context (root DN) and searches the entire LDAP +directory tree for sudoRole objects. Any LDAP principal with write access +to any subtree can inject a sudoRole granting arbitrary sudo privileges +on every enrolled host. + +This patch adds a warning log when the fallback occurs, alerting +administrators that their configuration searches the entire directory +tree for sudo rules. A future hardening step would be to default to +ou=sudoers, instead of the root DN. + +The warning approach preserves backwards compatibility while ensuring +administrators are aware of the security implications. + +Based on the patch by: Ian Murphy +Amended by: Alexey Tikhonov + +:fixes: CVE-2026-14474 + +Reviewed-by: Sumit Bose +Reviewed-by: Tomáš Halman +(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d) +--- + src/providers/ldap/sdap.c | 19 +++++++++++++++++++ + src/tests/system/tests/test_ldap.py | 2 +- + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c +index ef7b19049..09445f0c8 100644 +--- a/src/providers/ldap/sdap.c ++++ b/src/providers/ldap/sdap.c +@@ -1314,6 +1314,25 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse, + + /* Sudo */ + if (!sdom->sudo_search_bases) { ++ /* At some point make this option mandatory, ++ * i.e. disable sudo rules lookup if 'sudo_search_bases' not set. ++ */ ++ DEBUG(SSSDBG_IMPORTANT_INFO, ++ "`ldap_sudo_search_base` is not set. SSSD will search the entire " ++ "directory tree (%s) for sudoRole objects. This may allow any " ++ "LDAP principal with write access to any subtree to inject " ++ "sudo rules granting arbitrary privileges. Set " ++ "`ldap_sudo_search_base` to restrict the search scope " ++ "(e.g., 'ou=sudoers,dc=example,dc=com').\n", ++ sdom->naming_context); ++ sss_log(SSS_LOG_ALERT, ++ "`ldap_sudo_search_base` is not set. SSSD will search the entire " ++ "directory tree (%s) for sudoRole objects. This may allow any " ++ "LDAP principal with write access to any subtree to inject " ++ "sudo rules granting arbitrary privileges. Set " ++ "`ldap_sudo_search_base` to restrict the search scope " ++ "(e.g., 'ou=sudoers,dc=example,dc=com').", ++ sdom->naming_context); + ret = sdap_set_search_base(opts, sdom, + SDAP_SUDO_SEARCH_BASE, + sdom->naming_context); +diff --git a/src/tests/system/tests/test_ldap.py b/src/tests/system/tests/test_ldap.py +index 15b505b3d..646dffb0f 100644 +--- a/src/tests/system/tests/test_ldap.py ++++ b/src/tests/system/tests/test_ldap.py +@@ -137,7 +137,7 @@ def test_ldap__search_base_is_discovered_and_defaults_to_root_dse(client: Client + client.sssd.dom("test")["ldap_search_base"] = ldap.ldap.naming_context + + client.sssd.stop() +- client.sssd.clear() ++ client.sssd.clear(logs=True) + client.sssd.start() + + assert client.auth.ssh.password("puser1", "Secret123"), "User 'puser1' login failed!" +-- +2.54.0 + diff --git a/sssd.spec b/sssd.spec index 80b58a9..503519b 100644 --- a/sssd.spec +++ b/sssd.spec @@ -27,7 +27,7 @@ Name: sssd Version: 2.9.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: System Security Services Daemon License: GPLv3+ URL: https://github.com/SSSD/sssd/ @@ -36,6 +36,8 @@ Source0: https://github.com/SSSD/sssd/releases/download/%{version}/sssd-%{versio ### Patches ### Patch1: 0001-passwordless-gdm.patch Patch2: 0002-sysdb-enumpwent-replacement.patch +Patch3: 0003-gpo-reject-path-traversal-in-gPCFileSysPath.patch +Patch4: 0004-sudo-warn-when-ldap_sudo_search_base-falls-back-to-root-DN.patch ### Dependencies ### @@ -1085,6 +1087,10 @@ fi %systemd_postun_with_restart sssd.service %changelog +* Wed Jul 8 2026 Justin Stephenson - 2.9.9-3 +- Resolves: RHEL-192062 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation +- Resolves: RHEL-192072 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root + * Thu Jun 4 2026 Pavel Březina - 2.9.9-2 - Rebuild against samba-4.24