Skip to content

Commit

Permalink
mount.cifs: fix verbose messages on option parsing
Browse files Browse the repository at this point in the history 
When verbose logging is enabled, invalid credentials file lines may be
dumped to stderr. This may lead to information disclosure in particular
conditions when the credentials file given is sensitive and contains '='
signs.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15026

Signed-off-by: Jeffrey Bencteux <jbe@improsec.com>
Reviewed-by: David Disseldorp <ddiss@suse.de>
  • Loading branch information
@0x6a656666 @piastry
0x6a656666 authored and piastry committed Apr 27, 2022
1 parent 007c07f commit 8acc963
Showing 1 changed file with 1 addition and 5 deletions.
6 changes: 1 addition & 5 deletions mount.cifs.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -628,17 +628,13 @@ static int open_cred_file(char *file_name,
goto return_i;
break;
case CRED_DOM:
if (parsed_info->verboseflag)
fprintf(stderr, "domain=%s\n",
temp_val);
strlcpy(parsed_info->domain, temp_val,
sizeof(parsed_info->domain));
break;
case CRED_UNPARSEABLE:
if (parsed_info->verboseflag)
fprintf(stderr, "Credential formatted "
"incorrectly: %s\n",
temp_val ? temp_val : "(null)");
"incorrectly\n");
break;
}
}
Expand Down

4 comments on commit 8acc963

@carnil
Copy link

@carnil carnil commented on 8acc963 Apr 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CVE-2022-29869 is assigned for the issue fixed by this commit.

@piastry
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you want me to put CVE-2022-29869 prefix to the title of the commit before pushing to git.samba.org, so it is more visible?

@carnil
Copy link

@carnil carnil commented on 8acc963 Apr 29, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@piastry I guess it's not strictly needed, and would only do it if it does not cause issues with the commit history.

@piastry
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, will leave things as is to not cause conflicts to anyone who has already fetched the changes.

Please # to comment.