Samba needs two patches, unless you're happy for SMB servers to dance for evildoers

It’s time to patch Samba again - or turn off SAMBA 1, which is never as easy as it sounds. The lid came off the issue a couple of days ago, when the big Linux distributions (Red Hat, Ubuntu, Debian and so on) rolled out fixes for a use-after-free error affecting all versions of SAMBA since 4.0 (published in 2012). The bug …

[Anonymous Coward]

This is what happens when you let young developers write Linux code - no clue how to do memory management and garbage collection.

[Warm Braw]

This is what happens when you let any developers write code with tools that don't provide safe methods for memory management and garbage collection. The only thing age and experience will do is reduce the number of errors - it won't eliminate them.

[Anonymous Coward]

@Warm Brew.

Oh, I see, so instead of teaching developers about memory management etc, you think we should only let them code using tools that protect them from it and hide it all away, so they never have to bother about it?

Who writes the tools for the developers who write the tools? Do they need to know about garbage collection?

[FIA]

Oh, I see, so instead of teaching developers about memory management etc, you think we should only let them code using tools that protect them from it and hide it all away, so they never have to bother about it?

You missed the point. It isn't that you shouldn't teach these things, it's that if there's scope for mistakes to be made, then eventually there will be mistakes made. (True of life in general, not just software engineering).

Experience just means you know this. (and work/plan accordingly). No one suggested programmers shouldn't know about memory management and similar, just that they should be aware that people make mistakes.

[Anonymous Coward]

"write code with tools that don't provide safe methods for memory management and garbage collection"

Oh, I would like to see JSamba - 128GB or RAM to share a couple of files... and good luck at managing the message headers.

[bombastic bob]

re:write code with tools that don't provide safe methods for memory management and garbage coll...

"Oh, I would like to see JSamba - 128GB or RAM to share a couple of files... and good luck at managing the message headers."

yeah, THAT would "fix it"!

Considering that Java has no 'unsigned' data type, even... *nausea* (/me reaches for "pink liquid")

it could ONLY be worse if it were coded in PYTHON! (well, maybe COULD be worse than that, but I don't see it)

[Jeremy Allison]

This ! C is notoriously difficult to get right. If I had to do Samba again from scratch I'd chose golang.

[teknopaul]

Dumb statement: What makes you think the developers of samba 1 are young? Original author is 50.

[Captain Scarlet]

Thats weird, I have never heard of "Linux Code" before. I assumed they would have used C++, C or any other number of coding languages.

[Hans 1]

This is what happens when you let young developers write Linux code - no clue how to do memory management and garbage collection.

1. Samba is not Linux, it is userland stuff that runs atop Linux and various other OS'

2. Pure C is better, harder to get right, but better.

Now, if you want to understand what is going on in Linux development, eat this:

https://www.youtube.com/watch?v=vyenmLqJQjs

Go, watch, and think!

Icon => pints for Greg, Andrew, and Linus!

[bombastic bob]

"no clue how to do memory management and garbage collection."

REAL programmers do not NEED to do "garbage collection". They understand that for every 'malloc' or 'new', there must be a 'free' or 'delete'. And buffer sizes must be CHECKED. etc.

"garbage collection" is for those weenies who insist on using duck-typed languages. Or Java. *nausea*

[Jeremy Allison]

"REAL programmers do not NEED to do "garbage collection". They understand that for every 'malloc' or 'new', there must be a 'free' or 'delete'. And buffer sizes must be CHECKED. etc."

Samba uses the talloc library (invented locally) for this purpose. Check out https://talloc.samba.org/talloc/doc/html/index.html . It's a really nice piece of code which has stack/heap smashing protections etc. Lots of non-Samba code in Red Hat/Fedora also uses it.

Buffer overruns are harder, for much of SMB1/2/3 it's hard to auto-generate, as the protocol isn't defined in an interface definition language. Our DCE-RPC code is auto-generated and buffer overrun checked, as our IDL compiler (pidl) does this for us.

Unfortunately, due to C, these kind of bugs will always be with us. All we can do is be eternally vigilant and review everything.

[Anonymous Coward]

"They understand that for every..."

Yes, but you need exceptions to properly manage that - something C stubbornly avoids. C++ made things just more complex because it stubbornly avoids a "finally" statement - hence all the "smart" pointers to cater for that.

[Jeremy Allison]

Oooh. Thanks ! I never thought of myself as young at 55, but I'll take the compliment, thanks :-).

[tony2heads]

Samba again

Mas que nada

[Paul Herber]

Re: Samba again

pa ti

[CAPS LOCK]

Re: Samba again

For those unfortunates who don't know what Tony is going on about:

https://www.youtube.com/watch?v=9U1v01SGtGE

<wanders off snapping fingers>"Ooh, bar, ooh bar, ooh bar"

[patrickstar]

And I thought only the Windows SMB implementation had vulnerabilities?

[Anonymous Coward]

"And I thought only the Windows SMB implementation had vulnerabilities?"

Not as many as Samba has had! I can't imagine why anyone would run Samba out of choice. Windows Server is significantly faster on the same hardware.

[Zippy's Sausage Factory]

@Anonymous Coward Morning! How's the weather in Redmond these days?

[katrinab]

"Windows Server is significantly faster on the same hardware."

Really? FreeBSD + Samba is much quicker for me on slower hardware.

[Hans 1]

Really? FreeBSD + Samba is much quicker for me on slower hardware.

0wned!

You selected the incorrect icon!

[bombastic bob]

"FreeBSD + Samba is much quicker for me on slower hardware."

FreeBSD + Samba is much quicker for me, EVEN on slower hardware.

is that what you meant? Because, that's what _I_ have obseved!

[katrinab]

"FreeBSD + Samba is much quicker for me, EVEN on slower hardware.

is that what you meant? Because, that's what _I_ have obseved!"

Yes

[Hans 1]

Windows Server is significantly faster on the same hardware.

Source ?

Oh, crap, anon, did not notice ... sorry, troll on ...

[Anonymous Coward]

I can't imagine why anyone would run Samba out of choice

Yes. NFS is much simpler and higher performing. I guess people would rather serve with Samba, than jump through hoops to enable NFS on the Windows clients.

[Jeremy Allison]

NFS is a simpler protocol, but not necessarily higher performing. SMB1/2/3 has lots of tricks to improve performance and can quite easily saturate most ethernet links.

[Anonymous Bullard]

SMB1/2/3 has lots of tricks to improve performance

Oh really? And what would you know?

;-)

[Alan Brown]

"NFS is a simpler protocol, but not necessarily higher performing. "

*shuddering memories of PC-NFS on DOS boxes and windows3/95.

There's a more prosaic problem with NFS on linux boxes - it doesn't play nice with _anything_ else touching the same areas of the filesystem due to the way it's coded and lives in kernel-space (I was one of the misguided people who helped make it that way more than 20 years ago due to the abysmal userland performance(*) and I'm a mere spring chicken at 51)

Ganesha attempts to make up for things, but it's not easy to get running.

(*)it was less than 20% of the speed of the SunOs NFS server on equivalent hardware.

[monty75]

There's a bucketload of IoT devices out there with Samba sharing open to the world and nigh on zero chance of getting patched. Could get messy.

[Midnight]

There's a bucketload of IoT devices out there with Samba sharing open to the world and nigh on zero chance of getting patched. Could get messy.

I have always wondered how people got the initialism "IoT" from the full name "Botnet of Things".

[Jeremy Allison]

> Could get messy.

Almost certainly not from these specific bugs. They are not easily exploitable (but never say never of course). If a SMB server is not patched there are much easier exploitable issues than these recent ones to choose from.

[Jeremy Allison]

Error in the article text.

It states: "Samba's developers have detected exploits", that should be "Samba's developers have *NOT* detected exploits", because we haven't.

Never say never, but I can't see a way to exploit this (not that I'm an exploit expert). But better to fix than leave any possibility around.