Bug 2241882 (CVE-2023-4091)

Summary:	CVE-2023-4091 samba: SMB clients can truncate files with read-only permissions
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	nobody, pfilipen, rhs-smb, security-response-team, stefano.biagiotti
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.19.1, samba 4.18.8, samba 4.17.12	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2241916, 2243231
Bug Blocks:	2228383

Description TEJ RATHI 2023-10-03 07:34:29 UTC

SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "acl_xattr:ignore system acls = yes".

If the module configuration parameter "acl_xattr:ignore system acls=no", then the Samba server is not vulnerable to this attack.

https://bugzilla.samba.org/show_bug.cgi?id=15439

Comment 2 TEJ RATHI 2023-10-11 10:41:51 UTC

This CVE is now Public:
https://www.samba.org/samba/security/CVE-2023-4091.html

Comment 3 TEJ RATHI 2023-10-11 10:46:09 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2243231]

Comment 4 errata-xmlrpc 2023-10-31 10:05:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:6209 https://access.redhat.com/errata/RHSA-2023:6209

Comment 5 errata-xmlrpc 2023-11-07 10:08:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6744 https://access.redhat.com/errata/RHSA-2023:6744

Comment 6 errata-xmlrpc 2023-11-21 11:17:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2023:7371 https://access.redhat.com/errata/RHSA-2023:7371

Comment 7 errata-xmlrpc 2023-11-21 11:42:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7408 https://access.redhat.com/errata/RHSA-2023:7408

Comment 8 errata-xmlrpc 2023-11-22 17:27:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2023:7464 https://access.redhat.com/errata/RHSA-2023:7464

Comment 9 errata-xmlrpc 2023-11-22 17:29:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7467 https://access.redhat.com/errata/RHSA-2023:7467