From: Martin Schwenke <mschwenke@ddn.com>
Date: Tue, 30 Jun 2026 03:58:22 +0000 (+1000)
Subject: CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports
X-Git-Tag: talloc-2.5.0~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33667fa30d3e12f9f835b5670770ab702cf9e2c4;p=thirdparty%2Fsamba.git

CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports

We can't deal with this in the current CTDB protocol without
disproportionate effort.  So, document reality clearly in the code to
try to stop these from being reported.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/ctdb/common/ctdb_io.c b/ctdb/common/ctdb_io.c
index 9ac9b84a7fb..346a7456f47 100644
--- a/ctdb/common/ctdb_io.c
+++ b/ctdb/common/ctdb_io.c
@@ -115,7 +115,25 @@ static void queue_process(struct ctdb_queue *queue)
 		return;
 	}
 
-	/* Extract complete packet */
+	/*
+	 * Extract complete packet
+	 *
+	 * Yes, this allows an out-of-memory denial of service (DoS)
+	 * attack if a number of packets are received with
+	 * unreasonable packet sizes, noting that the maximum packet
+	 * size is ~4GB.  The CTDB protocol was not designed with a
+	 * maximum packet size in mind, so CTDB may send very large
+	 * valid packets.  This means that imposing an arbitrary limit
+	 * on incoming packets is not reasonable.  Arguments that
+	 * header fields, such as magic and/or version, should be
+	 * validated before allocating a packet buffer are spurious
+	 * from a security perspective because an attacker attempting
+	 * DoS can send packets with valid headers.  The private
+	 * network and ctdbd socket should be secured against
+	 * untrusted access, so reports that this possible DoS vector
+	 * represents a security issue will be ignored.  See the
+	 * "Private addresses" section in ctdb(7) for more details.
+	 */
 	data = talloc_memdup(queue->data_pool,
 			     queue->buffer.data + queue->buffer.offset,
 			     pkt_size);
diff --git a/ctdb/common/pkt_read.c b/ctdb/common/pkt_read.c
index 212ace54bbd..8877f6aa368 100644
--- a/ctdb/common/pkt_read.c
+++ b/ctdb/common/pkt_read.c
@@ -146,6 +146,25 @@ void pkt_read_handler(struct tevent_context *ev, struct tevent_fd *fde,
 		return;
 	}
 
+	/*
+	 * Allocate buffer for entire packet
+	 *
+	 * Yes, this allows an out-of-memory denial of service (DoS)
+	 * attack if a number of packets are received with
+	 * unreasonable packet sizes, noting that the maximum packet
+	 * size is ~4GB.  The CTDB protocol was not designed with a
+	 * maximum packet size in mind, so CTDB may send very large
+	 * valid packets.  This means that imposing an arbitrary limit
+	 * on incoming packets is not reasonable.  Arguments that
+	 * header fields, such as magic and/or version, should be
+	 * validated before allocating a packet buffer are spurious
+	 * from a security perspective because an attacker attempting
+	 * DoS can send packets with valid headers.  The private
+	 * network and ctdbd socket should be secured against
+	 * untrusted access, so reports that this possible DoS vector
+	 * represents a security issue will be ignored.  See the
+	 * "Private addresses" section in ctdb(7) for more details.
+	 */
 	if (state->use_fixed) {
 		/* switch to dynamic buffer */
 		tmp = talloc_array(state, uint8_t, state->total + more);