Vulnerability · Published Nov 3, 2023 · Assigned by redhat
CVE-2023-3961Samba: smbd allows client access to unix domain sockets on the file system as root
Critical 9.1
In plain English
A critical-severity path traversal in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.7%top 14.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ctdb | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | ctdb | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | libnetapi | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | libnetapi | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | libnetapi-devel | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | libnetapi-devel | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | libsmbclient | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | libsmbclient | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | libsmbclient-devel | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | libsmbclient-devel | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | libwbclient | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | libwbclient | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | libwbclient-devel | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | libwbclient-devel | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | python3-samba | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | python3-samba | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | python3-samba-dc | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | python3-samba-dc | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | python3-samba-devel | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | python3-samba-devel | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | python3-samba-test | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | python3-samba-test | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-client | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-client | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-client-libs | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-client-libs | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-common | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-common | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-common-libs | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-common-libs | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-common-tools | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-common-tools | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-dc-libs | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-dc-libs | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-dcerpc | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-dcerpc | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-devel | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-devel | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-krb5-printing | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-krb5-printing | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-ldb-ldap-modules | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-ldb-ldap-modules | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-libs | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-libs | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-pidl | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-pidl | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-test | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-test | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-test-libs | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-test-libs | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-tools | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-tools | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-usershares | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-usershares | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-vfs-iouring | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-vfs-iouring | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-winbind | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-winbind | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-winbind-clients | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-winbind-clients | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-winbind-krb5-locator | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-winbind-krb5-locator | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-winbind-modules | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-winbind-modules | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux:8 | samba-winexe | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
| AlmaLinux:9 | samba-winexe | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| Alpine:v3.20 | samba | 4.18.8-r0 | ALPINE-CVE-2023-3961 |
| Alpine:v3.21 | samba | 4.18.8-r0 | ALPINE-CVE-2023-3961 |
| Alpine:v3.22 | samba | 4.18.8-r0 | ALPINE-CVE-2023-3961 |
| Alpine:v3.23 | samba | 4.18.8-r0 | ALPINE-CVE-2023-3961 |
| Alpine:v3.24 | samba | 4.18.8-r0 | ALPINE-CVE-2023-3961 |
| Debian:12 | samba | 2:4.17.12+dfsg-0+deb12u1 | DEBIAN-CVE-2023-3961 |
| Debian:12 | samba | 2:4.17.12+dfsg-0+deb12u1 | DSA-5525-1 |
| Debian:13 | samba | 2:4.19.1+dfsg-1 | DEBIAN-CVE-2023-3961 |
| Debian:14 | samba | 2:4.19.1+dfsg-1 | DEBIAN-CVE-2023-3961 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | see references |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Storage 3 | see references |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- RHSA-2023:6209 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:6744 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7371 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7408 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7464 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7467 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-3961 vdb-entry, x_refsource_REDHAT
- RHBZ#2241881 issue-tracking, x_refsource_REDHAT
- https://bugzilla.samba.org/show_bug.cgi?id=15422
- https://www.samba.org/samba/security/CVE-2023-3961.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZUMVALLFFDFC53JZMUWA6HPD7HUGAP5I/ x_transferred
- https://security.netapp.com/advisory/ntap-20231124-0002/ x_transferred