CVE-2025-0620: smbd: smbd doesn't pick up group membership changes when re-authenticating an expired SMB session

slowfranklin · Jule Anger · commit 6f0ae60428a0 · 2025-06-02T15:10:30.000Z
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15707 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Jule Anger <janger@samba.org> Autobuild-Date(master): Mon Jun 2 15:10:30 UTC 2025 on atb-devel-224
diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c
@@ -173,8 +173,8 @@ static void conn_clear_vuid_cache(connection_struct *conn, uint64_t vuid)
 
 	for (i=0; i<VUID_CACHE_SIZE; i++) {
 		ent = &conn->vuid_cache->array[i];
-		if (ent->vuid != vuid) {
-			continue;
+		if (ent->vuid == vuid) {
+			break;
 		}
 	}
 	if (i == VUID_CACHE_SIZE) {

Original file line number	Diff line number	Diff line change
`@@ -173,8 +173,8 @@ static void conn_clear_vuid_cache(connection_struct *conn, uint64_t vuid)`
`173`	`173`
`174`	`174`	`for (i=0; i<VUID_CACHE_SIZE; i++) {`
`175`	`175`	`ent = &conn->vuid_cache->array[i];`
`176`		`- if (ent->vuid != vuid) {`
`177`		`- continue;`
	`176`	`+ if (ent->vuid == vuid) {`
	`177`	`+ break;`
`178`	`178`	`}`
`179`	`179`	`}`
`180`	`180`	`if (i == VUID_CACHE_SIZE) {`