Samba File Truncation Vulnerability: CVE-2023-4091
Summary
ALPINE-CVE-2023-4091: A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". Affects samba versions < 4.18.8-r0. Fixed in 4.18.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samba is an open-source software suite that provides seamless file and print services to SMB/CIFS clients. It allows for interoperability between Linux/Unix servers and Windows-based clients. Samba is widely used for sharing files and printers across different operating systems. However, it has been found to have a critical vulnerability that can lead to unintended file truncation, affecting data integrity and security.
Vulnerability Detail
A vulnerability was discovered in Samba, where SMB clients can truncate files even with read-only permissions. This occurs when the Samba VFS module 'acl_xattr' is configured with 'acl_xattr:ignore system acls = yes'. The flaw allows clients to open files with read-only access but then truncate them to 0 bytes if a separate OVERWRITE create disposition request is specified. This issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions, potentially leading to data loss and unauthorized modifications.
How To Fix
Minimum fixed version
4.18.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'acl_xattr:ignore system acls' configuration in your Samba settings. This will enforce stricter permission checks and prevent unauthorized file truncation. Modify your Samba configuration file (usually located at /etc/samba/smb.conf) and ensure the following line is set to 'no':
acl_xattr:ignore system acls = no
Conclusion
The Samba vulnerability CVE-2023-4091 poses a significant risk by allowing file truncation under specific configurations. It is crucial to update to the patched version to mitigate this risk and ensure data integrity. Additionally, implementing the suggested workaround can provide immediate relief until the update is applied.
See every vulnerability recorded for samba →
FAQ
CVE-2023-4091 is a vulnerability in Samba that allows SMB clients to truncate files with read-only permissions under certain configurations.
This vulnerability can lead to data loss as it allows unauthorized truncation of files, potentially compromising data integrity.
Samba versions prior to 4.18.8-r0 on Alpine Linux are affected by this vulnerability.
Yes, the patch is available in Samba version 4.18.8-r0 and later. Updating to this version will resolve the issue.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for samba.
