Skip to content
Fencer Vulns
medium 6.5

CVE-2023-4091 json

Samba: smb clients can truncate files with read-only permissions

published 2023-11-03 3 y ago modified 2026-11-07 41 h ago also EUVD-2023-53981

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:4.18.6-2.el8_9
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:4.15.5-13.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:4.17.5-4.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:4.18.6-101.el9_3
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 0:4.15.5-111.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:4.17.5-104.el9_2
  • Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 0:4.15.5-13.el8_6
  • samba Debian 12 2:4.17.12+dfsg-0+deb12u1
  • samba Debian 14, Debian 13 2:4.19.1+dfsg-1

debian advisories DEBIAN-CVE-2023-4091

  • samba Ubuntu 20.04 LTS 2:4.15.13+dfsg-0ubuntu0.20.04.6
  • samba Ubuntu 22.04 LTS 2:4.15.13+dfsg-0ubuntu1.5
  • samba Ubuntu 24.04 LTS 2:4.18.6+dfsg-1ubuntu2.1

ubuntu advisories UBUNTU-CVE-2023-4091

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba RHEL 8 4.18.6-2.el8_9
  • ctdb RHEL 8 4.18.6-2.el8_9
  • libnetapi RHEL 8 4.18.6-2.el8_9
  • samba-libs RHEL 8 4.18.6-2.el8_9
  • samba-pidl RHEL 8 4.18.6-2.el8_9
  • samba-test RHEL 8 4.18.6-2.el8_9
  • libwbclient RHEL 8 4.18.6-2.el8_9
  • samba-tools RHEL 8 4.18.6-2.el8_9

red hat advisories RHSA-2023:7467RHSA-2023:7464RHSA-2023:7408RHSA-2023:7371RHSA-2023:6744RHSA-2023:6209

  • samba SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +6 more 4.15.13+git.691.3d3cea0641-150300.3.63.1
  • samba SLE Module for Basesystem 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +2 more 4.15.13+git.691.3d3cea0641-150400.3.31.1
  • samba SLE Module for Basesystem 15 SP5, SLE Micro 5.5, SLE High Availability Extension 15 SP5 +1 more 4.17.9+git.421.abde31ca5c2-150500.3.11.1
  • samba SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 +1 more 4.15.13+git.625.ac658f2f12-3.88.1

suse advisories SUSE-SU-2023:4096-1SUSE-SU-2023:4059-1SUSE-SU-2023:4046-1SUSE-SU-2023:4040-1

  • samba openSUSE Tumbleweed 4.19.1+git.312.c912b3d2ef6-1.1

opensuse advisories openSUSE-SU-2024:13332-1

  • samba AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • ctdb AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • libnetapi AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-libs AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-pidl AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-test AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • libwbclient AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-tools AlmaLinux 8 4.18.6-2.el8_9.alma.1

almalinux advisories ALSA-2023:7467ALSA-2023:6744

  • samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 4.18.8-r0

alpine advisories ALPINE-CVE-2023-4091

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4091 updated cvss 6.5

samba: SMB clients can truncate files with read-only permissions

  • Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 more Red Hat Enterprise Linux 7 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +18 more Red Hat Storage 3 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +21 more
    affected: workaround, no fix planned “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~”
  • Red Hat CodeReady Linux Builder (v. 8) samba-devel 4.18.6-2.el8_9, ctdb-debuginfo 4.18.6-2.el8_9, libnetapi-devel 4.18.6-2.el8_9, samba-debuginfo 4.18.6-2.el8_9, libwbclient-devel 4.18.6-2.el8_9, samba-debugsource 4.18.6-2.el8_9, +24 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7467
  • Red Hat CodeReady Linux Builder (v. 9) samba-pidl 4.18.6-101.el9_3, samba-test 4.18.6-101.el9_3, samba-test-libs 4.18.6-101.el9_3, python3-samba-test 4.18.6-101.el9_3
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6744
  • Red Hat CodeReady Linux Builder EUS (v.8.6) samba-devel 4.15.5-13.el8_6, ctdb-debuginfo 4.15.5-13.el8_6, samba-debuginfo 4.15.5-13.el8_6, libwbclient-devel 4.15.5-13.el8_6, samba-debugsource 4.15.5-13.el8_6, libsmbclient-devel 4.15.5-13.el8_6, +17 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7408
  • Red Hat CodeReady Linux Builder EUS (v.8.8) samba-devel 4.17.5-4.el8_8, ctdb-debuginfo 4.17.5-4.el8_8, libnetapi-devel 4.17.5-4.el8_8, samba-debuginfo 4.17.5-4.el8_8, libwbclient-devel 4.17.5-4.el8_8, samba-debugsource 4.17.5-4.el8_8, +24 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7464
  • Red Hat CodeReady Linux Builder EUS (v.9.0) samba-pidl 4.15.5-111.el9_0, samba-test 4.15.5-111.el9_0, samba-test-libs 4.15.5-111.el9_0
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6209
  • Red Hat CodeReady Linux Builder EUS (v.9.2) samba-pidl 4.17.5-104.el9_2, samba-test 4.17.5-104.el9_2, samba-test-libs 4.17.5-104.el9_2, python3-samba-test 4.17.5-104.el9_2
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7371
  • Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring 4.18.6-2.el8_9
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7467
show 15 more
  • Red Hat Enterprise Linux AppStream (v. 9) samba-client 4.18.6-101.el9_3, samba-winexe 4.18.6-101.el9_3, samba-vfs-iouring 4.18.6-101.el9_3, samba-krb5-printing 4.18.6-101.el9_3, samba-winbind-clients 4.18.6-101.el9_3, samba-winbind-krb5-locator 4.18.6-101.el9_3
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6744
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) samba-vfs-iouring 4.15.5-13.el8_6
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7408
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) samba-vfs-iouring 4.17.5-4.el8_8
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7464
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) samba-client 4.15.5-111.el9_0, samba-winexe 4.15.5-111.el9_0, samba-vfs-iouring 4.15.5-111.el9_0, samba-krb5-printing 4.15.5-111.el9_0, samba-winbind-clients 4.15.5-111.el9_0, samba-winbind-krb5-locator 4.15.5-111.el9_0
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6209
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) samba-client 4.17.5-104.el9_2, samba-winexe 4.17.5-104.el9_2, samba-vfs-iouring 4.17.5-104.el9_2, samba-krb5-printing 4.17.5-104.el9_2, samba-winbind-clients 4.17.5-104.el9_2, samba-winbind-krb5-locator 4.17.5-104.el9_2
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7371
  • Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.18.6-2.el8_9, samba 4.18.6-2.el8_9, libnetapi 4.18.6-2.el8_9, samba-libs 4.18.6-2.el8_9, samba-pidl 4.18.6-2.el8_9, samba-test 4.18.6-2.el8_9, +22 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7467
  • Red Hat Enterprise Linux BaseOS (v. 9) samba 4.18.6-101.el9_3, libnetapi 4.18.6-101.el9_3, samba-libs 4.18.6-101.el9_3, libwbclient 4.18.6-101.el9_3, samba-tools 4.18.6-101.el9_3, libsmbclient 4.18.6-101.el9_3, +12 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6744
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) ctdb 4.15.5-13.el8_6, samba 4.15.5-13.el8_6, samba-libs 4.15.5-13.el8_6, samba-pidl 4.15.5-13.el8_6, samba-test 4.15.5-13.el8_6, libwbclient 4.15.5-13.el8_6, +15 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7408
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) ctdb 4.17.5-4.el8_8, samba 4.17.5-4.el8_8, libnetapi 4.17.5-4.el8_8, samba-libs 4.17.5-4.el8_8, samba-pidl 4.17.5-4.el8_8, samba-test 4.17.5-4.el8_8, +22 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7464
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) samba 4.15.5-111.el9_0, samba-libs 4.15.5-111.el9_0, libwbclient 4.15.5-111.el9_0, libsmbclient 4.15.5-111.el9_0, samba-common 4.15.5-111.el9_0, python3-samba 4.15.5-111.el9_0, +5 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6209
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) samba 4.17.5-104.el9_2, libnetapi 4.17.5-104.el9_2, samba-libs 4.17.5-104.el9_2, libwbclient 4.17.5-104.el9_2, samba-tools 4.17.5-104.el9_2, libsmbclient 4.17.5-104.el9_2, +12 more
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7371
  • Red Hat Enterprise Linux Resilient Storage (v. 9) ctdb 4.18.6-101.el9_3
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6744
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) ctdb 4.15.5-111.el9_0
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:6209
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) ctdb 4.17.5-104.el9_2
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7371
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 samba 4.15.5-13.el8_6, libwbclient 4.15.5-13.el8_6, libsmbclient 4.15.5-13.el8_6, samba-common 4.15.5-13.el8_6, samba-client-libs 4.15.5-13.el8_6, samba-common-libs 4.15.5-13.el8_6
    fixed: vendor fix “The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting: ~~~ "acl_xattr:ignore system acls = no" ~~~” RHSA-2023:7408

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Storage 3

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.