{"id":"CVE-2023-4091","title":"Samba: smb clients can truncate files with read-only permissions","summary":"A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module \"acl_xattr\" is configured with \"acl_xattr:ignore system acls = yes\". The SMB protocol…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-276"],"vendor":"Red Hat","product":"samba","affected":["samba (all versions)","samba (all versions)","samba (all versions)","samba (all versions)","samba (all versions)","samba (all versions)","samba (all versions)","samba (all versions)","samba (all versions)","samba","samba4","samba","samba"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-04-25T16:18:12.014053Z"},"published":"2023-11-03","updated":"2026-11-07","sourceUpdated":"2026-11-07T13:41:34.640Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-4091","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6209","label":"RHSA-2023:6209"},{"url":"https://access.redhat.com/errata/RHSA-2023:6744","label":"RHSA-2023:6744"},{"url":"https://access.redhat.com/errata/RHSA-2023:7371","label":"RHSA-2023:7371"},{"url":"https://access.redhat.com/errata/RHSA-2023:7408","label":"RHSA-2023:7408"},{"url":"https://access.redhat.com/errata/RHSA-2023:7464","label":"RHSA-2023:7464"},{"url":"https://access.redhat.com/errata/RHSA-2023:7467","label":"RHSA-2023:7467"},{"url":"https://access.redhat.com/security/cve/CVE-2023-4091"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241882","label":"RHBZ#2241882"},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=15439"},{"url":"https://www.samba.org/samba/security/CVE-2023-4091.html"}],"tags":["cve.org"],"epss":0.01334,"epssPercentile":0.71323,"ingestedAt":"2026-11-07T14:18:21.472Z","slug":"CVE-2023-4091","body":"## Overview\n\nA vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module \"acl_xattr\" is configured with \"acl_xattr:ignore system acls = yes\". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.\n\n## Affected\n\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba (all versions)`\n- `samba`\n- `samba4`\n- `samba`\n- `samba`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThe vulnerability is most commonly associated with the \"acl_xattr\" module and can be mitigated by setting:\n~~~\n\"acl_xattr:ignore system acls = no\"\n~~~","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}