fix CVE-2021-3671

backport-CVE-2021-3671.patch

@@ -0,0 +1,39 @@
+From 0cb4b939f192376bf5e33637863a91a20f74c5a5 Mon Sep 17 00:00:00 2001
+From: Luke Howard <lukeh@padl.com>
+Date: Fri, 27 Aug 2021 11:42:48 +1000
+Subject: [PATCH] CVE-2021-3671 HEIMDAL kdc: validate sname in TGS-REQ
+
+In tgs_build_reply(), validate the server name in the TGS-REQ is present before
+dereferencing.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770
+
+[abartlet@samba.org backported from from Heimdal
+commit 04171147948d0a3636bc6374181926f0fb2ec83a via reference
+to an earlier patch by Joseph Sutton]
+
+RN: An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ
+
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/heimdal/kdc/krb5tgs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
+index b76726cdd64..d143eb739eb 100644
+--- a/source4/heimdal/kdc/krb5tgs.c
++++ b/source4/heimdal/kdc/krb5tgs.c
+@@ -1603,6 +1603,10 @@ tgs_build_reply(krb5_context context,
+ 
+ 	s = &adtkt.cname;
+ 	r = adtkt.crealm;
++    } else if (s == NULL) {
++	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
++	krb5_set_error_message(context, ret, "No server in request");
++	goto out;
+     }
+ 
+     _krb5_principalname2krb5_principal(context, &sp, *s, r);
+-- 
+GitLab
+

samba.spec

@@ -49,7 +49,7 @@
 
 Name:           samba
 Version:        4.12.5
-Release:        6
+Release:        7
 
 Summary:        A suite for Linux to interoperate with Windows
 License:        GPLv3+ and LGPLv3+
@@ -74,6 +74,7 @@ Patch4:         CVE-2020-14323.patch
 Patch5:         CVE-2021-20277.patch
 Patch6:         CVE-2020-27840.patch
 Patch7:         CVE-2021-20254.patch
+Patch8:         backport-CVE-2021-3671.patch
 
 BuildRequires: avahi-devel bison cups-devel dbus-devel docbook-style-xsl e2fsprogs-devel flex gawk gnupg2 gnutls-devel >= 3.4.7 gpgme-devel
 BuildRequires: jansson-devel krb5-devel >= %{required_mit_krb5} libacl-devel libaio-devel libarchive-devel libattr-devel 
@@ -3208,6 +3209,12 @@ fi
 %endif
 
 %changelog
+* Mon Oct 25 2021 gaihuiying <gaihuiying1@huawei.com> - 4.12.5-7
+- Type:cves
+- ID:CVE-2021-3671
+- SUG:NA
+- DESC:fix CVE-2021-3671
+
 * Fri Sep 10 2021 gaihuiying <gaihuiying1@huawei.com> - 4.12.5-6
 - Type:bugfix
 - ID:NA