CVE-2023-4091 Information

Description

A vulnerability was discovered in Samba where the flaw allows SMB clients to truncate files even with read-only permissions when the Samba VFS module cl_xattr\ is configured with cl_xattr:ignore system acls = yes. The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks relying solely on Samba’s permissions.

Reference

https://www.samba.org/samba/security/CVE-2023-4091.html https://bugzilla.samba.org/show_bug.cgi?id=15439 https://access.redhat.com/errata/RHSA-2023:6209 https://bugzilla.redhat.com/show_bug.cgi?id=2241882 https://access.redhat.com/security/cve/CVE-2023-4091 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZUMVALLFFDFC53JZMUWA6HPD7HUGAP5I/