CVE-2023-4091

A vulnerability was discovered in Samba, where the flaw allows SMB clients
to truncate files, even with read-only permissions when the Samba VFS
module “acl_xattr” is configured with “acl_xattr:ignore system acls = yes”.
The SMB protocol allows opening files when the client requests read-only
access but then implicitly truncates the opened file to 0 bytes if the
client specifies a separate OVERWRITE create disposition request. The issue
arises in configurations that bypass kernel file system permissions checks,
relying solely on Samba’s permissions.

Bugs

• <https://bugzilla.samba.org/show_bug.cgi?id=15439&gt;

Notes