CVE-2023-4091

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-4091
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-4091.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-4091
Downstream
ALPINE (1)
AZL (2)
CLSA (3)
DEBIAN (1)
MGASA (1)
OESA (5)
openSUSE (1)
RHSA (6)
SUSE (4)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (4)
USN (1)
Published
2023-11-03T07:56:35Z
Modified
2026-10-16T02:51:57Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Samba: smb clients can truncate files with read-only permissions
Details

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-276"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4091.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0:4.18.6-2.el8_9"
                        },
                        {
                            "fixed":  "0:4.18.6-2.el8_9"
                        },
                        {
                            "fixed":  "0:4.15.5-13.el8_6"
                        },
                        {
                            "fixed":  "0:4.17.5-4.el8_8"
                        },
                        {
                            "fixed":  "0:4.18.6-101.el9_3"
                        },
                        {
                            "fixed":  "0:4.18.6-101.el9_3"
                        },
                        {
                            "fixed":  "0:4.15.5-111.el9_0"
                        },
                        {
                            "fixed":  "0:4.17.5-104.el9_2"
                        },
                        {
                            "fixed":  "0:4.15.5-13.el8_6"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/samba-team/samba

Affected ranges

Type
GIT
Repo
https://github.com/samba-team/samba
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ec207cd4146919e4ee88e5522647c169baf6922
Introduced
a597a8767fabfe85ee0bcf869407e770a0c3e184
Fixed
f1c0d4f1feb8105d22307e29150e0b7d59b5fed9
Introduced
b7921852ad6ac048abbbe577b9faced2d694c685
Fixed
d9e90993b4049bac99227c8f3c8823df45f7f46d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "4.17.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.18.0"
                },
                {
                    "fixed":  "4.18.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.19.0"
                },
                {
                    "fixed":  "4.19.1"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

ldb-1.*
ldb-1.1.0
ldb-1.1.10
ldb-1.1.11
ldb-1.1.12
ldb-1.1.13
ldb-1.1.14
ldb-1.1.15
ldb-1.1.16
ldb-1.1.17
ldb-1.1.18
ldb-1.1.19
ldb-1.1.2
ldb-1.1.20
ldb-1.1.21
ldb-1.1.22
ldb-1.1.23
ldb-1.1.25
ldb-1.1.26
ldb-1.1.27
ldb-1.1.28
ldb-1.1.29
ldb-1.1.3
ldb-1.1.30
ldb-1.1.31
ldb-1.1.4
ldb-1.1.5
ldb-1.1.6
ldb-1.1.8
ldb-1.1.9
ldb-1.2.0
ldb-1.2.1
ldb-1.2.2
ldb-1.3.0
ldb-1.3.1
ldb-1.3.2
ldb-1.4.0
ldb-1.4.1
ldb-1.5.0
ldb-1.5.1
ldb-1.5.2
ldb-1.6.1
ldb-1.6.2
ldb-1.6.3
ldb-2.*
ldb-2.0.5
ldb-2.1.0
ldb-2.1.1
ldb-2.2.0
ldb-2.4.0
ldb-2.5.0
ldb-2.6.0
ldb-2.6.1
ldb-2.6.2
ldb-2.7.2
samba-4.*
samba-4.0.0alpha10
samba-4.0.0alpha17
samba-4.0.0alpha18
samba-4.0.0alpha19
samba-4.0.0alpha20
samba-4.0.0alpha21
samba-4.0.0alpha6
samba-4.0.0alpha7
samba-4.0.0alpha8
samba-4.0.0alpha9
samba-4.0.0beta1
samba-4.0.0beta2
samba-4.0.0beta3
samba-4.0.0beta4
samba-4.0.0beta5
samba-4.0.0beta6
samba-4.0.0beta7
samba-4.0.0beta8
samba-4.0.0rc1
samba-4.10.0rc1
samba-4.11.0rc1
samba-4.12.0rc1
samba-4.13.0rc1
samba-4.14.0rc1
samba-4.15.0rc1
samba-4.16.0rc1
samba-4.17.0
samba-4.17.0rc1
samba-4.17.0rc2
samba-4.17.0rc3
samba-4.17.0rc4
samba-4.17.0rc5
samba-4.17.1
samba-4.17.10
samba-4.17.11
samba-4.17.2
samba-4.17.4
samba-4.17.5
samba-4.17.6
samba-4.17.7
samba-4.17.8
samba-4.17.9
samba-4.18.0
samba-4.18.1
samba-4.18.2
samba-4.18.3
samba-4.18.4
samba-4.18.6
samba-4.18.7
samba-4.19.0
samba-4.2.0rc1
samba-4.3.0rc1
samba-4.4.0rc1
samba-4.5.0rc1
samba-4.6.0rc1
samba-4.7.0rc1
samba-4.8.0rc1
samba-4.9.0rc1
talloc-1.*
talloc-1.3.1
talloc-2.*
talloc-2.0.0
talloc-2.0.7
talloc-2.0.8
talloc-2.1.0
talloc-2.1.1
talloc-2.1.10
talloc-2.1.11
talloc-2.1.12
talloc-2.1.13
talloc-2.1.14
talloc-2.1.15
talloc-2.1.16
talloc-2.1.2
talloc-2.1.3
talloc-2.1.4
talloc-2.1.5
talloc-2.1.6
talloc-2.1.7
talloc-2.1.8
talloc-2.1.9
talloc-2.2.0
talloc-2.3.0
talloc-2.3.1
talloc-2.3.2
talloc-2.3.3
talloc-2.3.4
tdb-1.*
tdb-1.1.5
tdb-1.2.0
tdb-1.2.1
tdb-1.2.10
tdb-1.2.11
tdb-1.2.12
tdb-1.2.13
tdb-1.3.0
tdb-1.3.1
tdb-1.3.10
tdb-1.3.11
tdb-1.3.12
tdb-1.3.13
tdb-1.3.14
tdb-1.3.15
tdb-1.3.16
tdb-1.3.17
tdb-1.3.18
tdb-1.3.2
tdb-1.3.3
tdb-1.3.4
tdb-1.3.5
tdb-1.3.6
tdb-1.3.7
tdb-1.3.8
tdb-1.3.9
tdb-1.4.0
tdb-1.4.1
tdb-1.4.2
tdb-1.4.3
tdb-1.4.4
tdb-1.4.5
tdb-1.4.6
tdb-1.4.7
tevent-0.*
tevent-0.10.0
tevent-0.10.1
tevent-0.10.2
tevent-0.11.0
tevent-0.12.0
tevent-0.12.1
tevent-0.13.0
tevent-0.9.11
tevent-0.9.12
tevent-0.9.13
tevent-0.9.14
tevent-0.9.15
tevent-0.9.16
tevent-0.9.17
tevent-0.9.18
tevent-0.9.19
tevent-0.9.20
tevent-0.9.21
tevent-0.9.22
tevent-0.9.23
tevent-0.9.24
tevent-0.9.25
tevent-0.9.26
tevent-0.9.27
tevent-0.9.28
tevent-0.9.29
tevent-0.9.30
tevent-0.9.31
tevent-0.9.32
tevent-0.9.33
tevent-0.9.34
tevent-0.9.35
tevent-0.9.36
tevent-0.9.37
tevent-0.9.38
tevent-0.9.39
tevent-0.9.8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-4091.json"