CVE-2023-3961 Samba smbd Privilege Escalation via Unix Domain Socket

Vulnerability Key Information CVE ID: CVE-2023-3961 Description: allows clients to connect to Unix domain sockets on the filesystem with root privileges. Report Date: 2023-10-03 Status: NEW Product: Security Response Component: vulnerability Priority: Medium Severity: Medium Fixed Versions: - samba 4.19.1 - samba 4.18.8 - samba 4.17.12 Dependencies: - Depends on: #2241916, #2243228 - Blocks: #228383 Vulnerability Details Description: Samba internally concatenates client pipe names to Unix domain sockets, allowing clients to connect to services listening on those sockets. However, incoming client pipe names are not adequately sanitized, enabling an SMB client to connect to existing Unix domain sockets on the filesystem as root. This means that if a client can send a pipe name that resolves to an external Unix domain socket, the client can connect to it without being restricted by filesystem permissions. Public Links CVE-2023-3961 Security Advisory Fixes Red Hat Enterprise Linux 9.0 Extended Update Support: RHSA-2023:6209 Red Hat Enterprise Linux 9: RHSA-2023:6744 Red Hat Enterprise Linux 9.2 Extended Update Support: RHSA-2023:7371 Red Hat Enterprise Linux 8.6 Extended Update Support: RHSA-2023:7408 Red Hat Enterprise Linux 8.8 Extended Update Support: RHSA-2023:7464 Red Hat Enterprise Linux 8: RHSA-2023:7467

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-3961 Samba smbd Privilege Escalation via Unix Domain Socket