russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Permalink Blame History

Samba — CWE-407 Disclosure Brief (samba-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(N²) dedup scan in security_token_create() at source4/dsdb/samdb/samdb.c. For each incoming SID, the code scans all previously accepted SIDs linearly using dom_sid_equal(). With a Kerberos PAC carrying ~500 group SIDs, this produces ~125,000 comparisons at every login.

The Defect

samba-0002 (PATCHED — HIGH): source4/dsdb/samdb/samdb.c

for (i = 0; i < num_sids; i++) {
    uint32_t check_sid_idx;
    for (check_sid_idx = 0; check_sid_idx < ptoken->num_sids; check_sid_idx++) {
        if (dom_sid_equal(&ptoken->sids[check_sid_idx], &sids[i].sid)) {
            break;  // O(N) dedup per SID
        }
    }

The same pattern repeats for device SIDs in compound authentication.

Complexity Proof

At N=500 group SIDs in a Kerberos PAC:

Defective: 500 × 500/2 = 125,000 dom_sid_equal() calls per login
Fixed: 500 × O(log N) binary insertion = 500 × 9 = 4,500 comparisons
27× op reduction per login

Impact

Samba handles Kerberos authentication for Active Directory domains. Token creation fires on every user login, every service ticket validation, and every compound authentication. Enterprise environments with deeply nested group hierarchies produce PACs with hundreds of SIDs. This cost hits every authentication event.

The Fix

Replace the O(N²) nested-loop dedup with binary insertion sort into a sorted scratch array:

static uint32_t sid_sorted_insert_unique(struct dom_sid *scratch,
                                         uint32_t count,
                                         const struct dom_sid *sid)

Each membership test costs O(log N) via binary search + O(N) shift for insertion, giving O(N log N) total token build cost instead of O(N²).

Patch

Fix available: defects/samba-0002/patch/samba-0002.patch

27× op reduction at N=500 SIDs per login event.

What We Ask

Confirm receipt and assign a Bugzilla reference (bugzilla.samba.org).
Assess severity — fires on every Kerberos login and ticket validation.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Samba team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Permalink Blame History Unescape Escape