Bug 2241882 (CVE-2023-4091) - CVE-2023-4091 samba: SMB clients can truncate files with read-only permissions
Summary: CVE-2023-4091 samba: SMB clients can truncate files with read-only permissions
Keywords:
Status: NEW
Alias: CVE-2023-4091
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2241916 2243231
Blocks: 2228383
TreeView+ depends on / blocked
 
Reported: 2023-10-03 07:34 UTC by TEJ RATHI
Modified: 2024-04-03 08:09 UTC (History)
5 users (show)

Fixed In Version: samba 4.19.1, samba 4.18.8, samba 4.17.12
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:6209 0 None None None 2023-10-31 10:05:15 UTC
Red Hat Product Errata RHSA-2023:6744 0 None None None 2023-11-07 10:08:16 UTC
Red Hat Product Errata RHSA-2023:7371 0 None None None 2023-11-21 11:17:30 UTC
Red Hat Product Errata RHSA-2023:7408 0 None None None 2023-11-21 11:42:38 UTC
Red Hat Product Errata RHSA-2023:7464 0 None None None 2023-11-22 17:27:15 UTC
Red Hat Product Errata RHSA-2023:7467 0 None None None 2023-11-22 17:29:48 UTC

Description TEJ RATHI 2023-10-03 07:34:29 UTC 
SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "acl_xattr:ignore system acls = yes".

If the module configuration parameter "acl_xattr:ignore system acls=no", then the Samba server is not vulnerable to this attack.

https://bugzilla.samba.org/show_bug.cgi?id=15439
Comment 2 TEJ RATHI 2023-10-11 10:41:51 UTC 
This CVE is now Public:
https://www.samba.org/samba/security/CVE-2023-4091.html
Comment 3 TEJ RATHI 2023-10-11 10:46:09 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2243231]
Comment 4 errata-xmlrpc 2023-10-31 10:05:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:6209 https://access.redhat.com/errata/RHSA-2023:6209
Comment 5 errata-xmlrpc 2023-11-07 10:08:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6744 https://access.redhat.com/errata/RHSA-2023:6744
Comment 6 errata-xmlrpc 2023-11-21 11:17:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2023:7371 https://access.redhat.com/errata/RHSA-2023:7371
Comment 7 errata-xmlrpc 2023-11-21 11:42:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7408 https://access.redhat.com/errata/RHSA-2023:7408
Comment 8 errata-xmlrpc 2023-11-22 17:27:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2023:7464 https://access.redhat.com/errata/RHSA-2023:7464
Comment 9 errata-xmlrpc 2023-11-22 17:29:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7467 https://access.redhat.com/errata/RHSA-2023:7467
Note You need to log in before you can comment on or make changes to this bug.