CVE-2023-4091: Samba: smb clients can truncate files with read-only permissions
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "aclxattr" is configured with "aclxattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
Other sources
SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the aclxattr Samba VFS module with the smb.conf setting "aclxattr:ignore system acls = yes".
If the module configuration parameter "aclxattr:ignore system acls=no", then the Samba server is not vulnerable to this attack.
https://bugzilla.samba.org/showbug.cgi?id=15439
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4091?
CVE-2023-4091 is a vulnerability that allows SMB clients to truncate files with read-only permissions.
How does CVE-2023-4091 impact SMB clients?
CVE-2023-4091 allows SMB clients to truncate files even if they only have read-only permissions.
Which software is affected by CVE-2023-4091?
Samba versions up to 2:4.15.13+dfsg-0ubuntu0.20.04.6, 2:4.15.13+dfsg-0ubuntu1.5, and 2:4.17.7+dfsg-1ubuntu2.3 are affected by CVE-2023-4091.
How can I fix CVE-2023-4091?
To fix CVE-2023-4091, update Samba to version 2:4.15.13+dfsg-0ubuntu0.20.04.6, 2:4.15.13+dfsg-0ubuntu1.5, or 2:4.17.7+dfsg-1ubuntu2.3 depending on your Ubuntu release.
Where can I find more information about CVE-2023-4091?
You can find more information about CVE-2023-4091 on the MITRE CVE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4091), the Samba security page (https://www.samba.org/samba/security/CVE-2023-4091.html), and the Ubuntu security notices (https://ubuntu.com/security/notices/USN-6425-1).