Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2023-4091

Samba: smb clients can truncate files with read-only permissions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.18.6-2.el8_9 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.18.6-2.el8_9 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support

Default version status: affected

  • 0:4.15.5-13.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

Default version status: affected

  • 0:4.17.5-4.el8_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:4.18.6-101.el9_3 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:4.18.6-101.el9_3 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support

Default version status: affected

  • 0:4.15.5-111.el9_0 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support

Default version status: affected

  • 0:4.17.5-104.el9_2 to < *unaffected

Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.15.5-13.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

Red Hat Red Hat Storage 3

Default version status: unknown

References