CVE-2023-4091Medium· 6.5▾ SunlitA vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.3%
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)sambasamba4sambasambaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting:
"acl_xattr:ignore system acls = no"
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-3961Critical· 9.1Samba: smbd allows client access to unix domain sockets on the file system as root
CVE-2023-42669Medium· 6.5Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc
CVE-2023-42670Medium· 6.5Samba: ad dc busy rpc multiple listener dos
CVE-2023-34966High· 7.5Samba: infinite loop in mdssvc rpc service for spotlight
CVE-2023-3347Medium· 5.9Samba: smb2 packet signing is not enforced when "server signing = required" is set
CVE-2023-34967Medium· 5.3Samba: type confusion in mdssvc rpc service for spotlight