---
id: CVE-2023-4091
title: 'Samba: smb clients can truncate files with read-only permissions'
summary: >-
  A vulnerability was discovered in Samba, where the flaw allows SMB clients to
  truncate files, even with read-only permissions when the Samba VFS module
  "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB
  protocol…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-276
vendor: Red Hat
product: samba
affected:
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba
  - samba4
  - samba
  - samba
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-04-25T16:18:12.014053Z'
published: '2023-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T13:41:34.640Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-4091'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:6209'
    label: 'RHSA-2023:6209'
  - url: 'https://access.redhat.com/errata/RHSA-2023:6744'
    label: 'RHSA-2023:6744'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7371'
    label: 'RHSA-2023:7371'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7408'
    label: 'RHSA-2023:7408'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7464'
    label: 'RHSA-2023:7464'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7467'
    label: 'RHSA-2023:7467'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-4091'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2241882'
    label: RHBZ#2241882
  - url: 'https://bugzilla.samba.org/show_bug.cgi?id=15439'
  - url: 'https://www.samba.org/samba/security/CVE-2023-4091.html'
tags:
  - cve.org
epss: 0.01334
epssPercentile: 0.71323
ingestedAt: '2026-11-07T14:18:21.472Z'
---

## Overview

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

## Affected

- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba`
- `samba4`
- `samba`
- `samba`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting:
~~~
"acl_xattr:ignore system acls = no"
~~~