CVE-2023-4091
Samba: smb clients can truncate files with read-only permissions
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
Se descubrió una vulnerabilidad en Samba, donde la falla permite a los clientes SMB truncar archivos, incluso con permisos de solo lectura cuando el módulo Samba VFS "acl_xattr" está configurado con "acl_xattr:ignore system acls = yes". El protocolo SMB permite abrir archivos cuando el cliente solicita acceso de solo lectura, pero luego trunca implícitamente el archivo abierto a 0 bytes si el cliente especifica una solicitud de disposición de creación de SOBRESCRITURA separada. El problema surge en configuraciones que omiten las comprobaciones de permisos del sistema de archivos del kernel y dependen únicamente de los permisos de Samba.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-08-02 CVE Reserved
- 2023-10-11 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-276: Incorrect Default Permissions
CAPEC
References (13)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2023:6209 | 2024-04-22 | |
| https://access.redhat.com/errata/RHSA-2023:6744 | 2024-04-22 | |
| https://access.redhat.com/errata/RHSA-2023:7371 | 2024-04-22 | |
| https://access.redhat.com/errata/RHSA-2023:7408 | 2024-04-22 | |
| https://access.redhat.com/errata/RHSA-2023:7464 | 2024-04-22 | |
| https://access.redhat.com/errata/RHSA-2023:7467 | 2024-04-22 | |
| https://access.redhat.com/security/cve/CVE-2023-4091 | 2023-11-22 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2241882 | 2023-11-22 | |
| https://www.samba.org/samba/security/CVE-2023-4091.html | 2024-04-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Samba Search vendor "Samba" | Samba Search vendor "Samba" for product "Samba" | < 4.17.12 Search vendor "Samba" for product "Samba" and version " < 4.17.12" | - |
Affected
| ||||||
| Samba Search vendor "Samba" | Samba Search vendor "Samba" for product "Samba" | >= 4.18.0 < 4.18.8 Search vendor "Samba" for product "Samba" and version " >= 4.18.0 < 4.18.8" | - |
Affected
| ||||||
| Samba Search vendor "Samba" | Samba Search vendor "Samba" for product "Samba" | >= 4.19.0 < 4.19.1 Search vendor "Samba" for product "Samba" and version " >= 4.19.0 < 4.19.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 39 Search vendor "Fedoraproject" for product "Fedora" and version "39" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Storage Search vendor "Redhat" for product "Storage" | 3.0 Search vendor "Redhat" for product "Storage" and version "3.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus" | 9.0 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "9.0" | - |
Affected
| ||||||