CVE-2023-4091
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A vulnerability was discovered in Samba that allows SMB clients to truncate files even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files with read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request.
Risk Assessment
An attacker could erase the contents of files they only have read access to, causing data loss. The issue occurs in configurations that bypass kernel file system permission checks.
Recommendation
Update Samba to a patched version. Avoid "acl_xattr:ignore system acls = yes" or restrict share access.
Other vulnerabilities in Samba
See all- CVE-2026-58222High
A vulnerability in Samba Active Directory Domain Controller (AD DC) combines LDAP filter injection with improper authorization checks, allowing an authenticated low-privilege domain user to disclose confidential AD attributes such as msKds-RootKeyData, potentially leading to privilege escalation and full domain compromise.
- CVE-2017-15275High
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.
- CVE-2016-2119High
In Samba library versions 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5, a vulnerability allows man-in-the-middle attackers to bypass a client-signing protection mechanism. This enables spoofing of SMB2 and SMB3 servers.
- CVE-2016-2113High
Samba versions 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 do not verify X.509 certificates from TLS servers, allowing man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
- CVE-2015-8467High
The samldb_check_user_account_control_acl function in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during the creation of machine accounts. This allows remote authenticated users to bypass intended access restrictions.
- CVE-2015-5252High
In Samba versions 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, a vulnerability allows remote attackers to bypass intended file-access restrictions via a symlink pointing outside of a share when certain substring relationships in share names exist.
- CVE-2015-0240High
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, allowing remote attackers to execute arbitrary code via crafted Netlogon packets.
- CVE-2014-8143High
Samba versions 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allow remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, consequently gaining privileges.
- CVE-2026-58221Medium
A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.
- CVE-2026-4408Critical
A flaw in Samba allows remote command execution due to improper escaping of shell meta-characters in the 'check password script' feature when using the %u substitution. This affects non-standard configurations with samba-dcerpcd running as a system service.
Original NVD description (English source)
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS