libcurl's SMB handler marks connections for reuse (connkeep) without verifying that subsequent requests target the same share. This allows a second SMB request to the same host to reuse a connection authenticated for a different share, potentially accessing data without proper authorization.
The upstream fix removes connection reuse for SMB entirely in lib/protocol.c, a file introduced in curl 8.20.0. For 8.7.1, the equivalent fix is changing connkeep() to connclose() in lib/smb.c, which prevents the connection from being returned to the pool. Tested with SMBv1 server (Docker dperson/samba): Without patch: "Re-using existing connection" for different shares With patch: New connection per request, no reuse Binary verified: Curl_conncontrol arg changes from 0 (KEEP) to 1 (CLOSE) Reference: https://curl.se/docs/CVE-2026-5773.html Signed-off-by: Jaipaul Cheernam <[email protected]> --- .../curl/curl/CVE-2026-5773.patch | 41 +++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5773.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-5773.patch b/meta/recipes-support/curl/curl/CVE-2026-5773.patch new file mode 100644 index 0000000000..0a5fa588fe --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-5773.patch @@ -0,0 +1,41 @@ +From 74a169575d6412dc0ff532acdf94de35a6c2a571 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Sun, 5 Apr 2026 18:23:35 +0200 +Subject: [PATCH] protocol: disable connection reuse for SMB(S) + +Connections should only be reused when using the same "share" (and +perhaps some additional conditions), but instead of fixing this flaw, +this change completely disables connection reuse for SMB. This protocol +is about to get dropped soon anyway. + +Reported-by: Osama Hamad +Closes #21238 +Signed-off-by: Daniel Stenberg <[email protected]> + +CVE: CVE-2026-5773 +Upstream-Status: Backport [https://github.com/curl/curl/commit/74a169575d6412dc0ff532acdf94de35a6c2a571] + +Note: The upstream fix targets lib/protocol.c which was introduced in +curl 8.20.0. In 8.7.1 the equivalent is changing connkeep() to +connclose() in lib/smb.c, which prevents the connection from being +returned to the pool. The effect is identical. + +Signed-off-by: Jaipaul Cheernam <[email protected]> +--- + lib/smb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/smb.c b/lib/smb.c +index 7c73cbcec..a1f5c9b31 100644 +--- a/lib/smb.c ++++ b/lib/smb.c +@@ -461,8 +461,7 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done) + if(!smbc->send_buf) + return CURLE_OUT_OF_MEMORY; + +- /* Multiple requests are allowed with this connection */ +- connkeep(conn, "SMB default"); ++ connclose(conn, "SMB default"); + + /* Parse the username, domain, and password */ + slash = strchr(conn->user, '/'); diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 14d63d6373..d026731751 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -36,6 +36,7 @@ SRC_URI = " \ file://CVE-2026-1965-2.patch \ file://CVE-2026-3783.patch \ file://CVE-2026-3784.patch \ + file://CVE-2026-5773.patch \ " SRC_URI:append:class-nativesdk = " \ -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#239479): https://lists.openembedded.org/g/openembedded-core/message/239479 Mute This Topic: https://lists.openembedded.org/mt/119954021/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
