CVE-2023-4091

medium

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xa…

Vendor / product: Samba — samba

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

CVSS

6.5

6.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2023-11-03 08:15

Modified: 2026-11-07 14:16

NVD status: Modified

Last synced 4 days ago

Verified against the source API 2026-11-07 14:18 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

samba / samba <4.17.12, ≥4.18.0 <4.18.8, ≥4.19.0 <4.19.1

fedoraproject / fedora 39

redhat / storage 3.0

redhat / enterprise_linux 8.0

redhat / enterprise_linux_eus 9.0

Weakness classification (CWE)

CWE-276

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://www.samba.org/samba/security/CVE-2023-4091.html

References

https://access.redhat.com/errata/RHSA-2023:6209 secalert@redhat.com
https://access.redhat.com/errata/RHSA-2023:6744 secalert@redhat.com
https://access.redhat.com/errata/RHSA-2023:7371 secalert@redhat.com
https://access.redhat.com/errata/RHSA-2023:7408 secalert@redhat.com
https://access.redhat.com/errata/RHSA-2023:7464 secalert@redhat.com
https://access.redhat.com/errata/RHSA-2023:7467 secalert@redhat.com
https://access.redhat.com/security/cve/CVE-2023-4091 secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2241882 secalert@redhat.com
https://bugzilla.samba.org/show_bug.cgi?id=15439 secalert@redhat.com
https://www.samba.org/samba/security/CVE-2023-4091.html secalert@redhat.com
https://access.redhat.com/errata/RHSA-2023:6209 af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2023:6744 af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2023:7371 af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2023:7408 af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2023:7464 af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2023:7467 af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/security/cve/CVE-2023-4091 af854a3a-2127-422b-91ae-364da2661108
https://bugzilla.redhat.com/show_bug.cgi?id=2241882 af854a3a-2127-422b-91ae-364da2661108
https://bugzilla.samba.org/show_bug.cgi?id=15439 af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html af854a3a-2127-422b-91ae-364da2661108
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/mes... af854a3a-2127-422b-91ae-364da2661108
https://security.netapp.com/advisory/ntap-20231124-0002/ af854a3a-2127-422b-91ae-364da2661108
https://www.samba.org/samba/security/CVE-2023-4091.html af854a3a-2127-422b-91ae-364da2661108

Data sources

NVD CVE API 2.0 — fetched 2026-11-07 14:18 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2023-4091

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs